Written technical positions
How we think about the work — judge the engineering before you ever talk to us.
- Comparison
CSPM severity vs attack-path prioritization
Why a flat CVSS/CSPM severity list buries the findings that can actually breach you, and how to re-rank by reachability and blast radius.
- Comparison
AI governance SaaS vs policy-as-code you own
A dashboard watches your AI usage; policy-as-code refuses what breaks the rules. Only the second keeps working after you cancel the subscription.
A landing zone you can’t apply yourself is just someone else’s repo
The test of a cloud foundation isn’t the architecture diagram — it’s whether your own team can vend account 51 from the repo without calling anyone.
Ship the code, not the slide deck
Why an infrastructure engagement should end in code that runs in your account, and why a recommendation-to-build hands the hard part back to you.
What AI models really cost
List price per million tokens hides what you pay for capability. Live data from our AI Rating API shows the gap, and how to pick a model per task.
Find expiring Entra ID app secrets before production does
Where Entra ID app secrets and certificates live, the one read-only Graph permission that lists them, a working script, and how to need fewer of them.
Ranking six cloud findings by attack path
A worked example: six findings from our fictional 48-account AWS sample review, ranked by signature, then by entry, identity and blast radius.
- Comparison
AWS Control Tower vs a custom landing zone
Control Tower, Landing Zone Accelerator or your own Terraform: what each costs in ownership, drift and upgrades, and how to choose an AWS landing zone.
- Comparison
ZTNA vs VPN for remote staff and contractors
What zero-trust network access changes over a VPN, what it doesn’t fix on its own, and how to move remote staff and contractors without lockouts.