4 posts
A supply chain attack turned Trivy, a popular security scanner, into a credential stealer inside CI/CD pipelines. How to harden for all three stages, preventing the compromise, limiting the damage, and recovering fast.
How to decide where proactive security effort goes when nothing is telling you what to do next. Spot your weakest capability, define "good enough," and know when to move on instead of over-optimising one area.
Why the standard AWS cost optimization playbook is technically right, but still needs business and architecture context before buying long-term commitments.
How to run a security evaluation when a new SaaS vendor lands on your desk, including risk tiering, what to check, reading a SOC 2, Singapore and global compliance, and starter templates.