Blog
Writing
Notes on cloud security, zero trust, and securing AI systems.
- Skill scanners with a local LLM judge: what changes? (part 2)
Part 2 of my Skill scanner test: the same 18 planted flaws and 6 harmless controls, now with each scanner's LLM stage running on a small local model with no network. What it caught, what it flagged by mistake, and how repeatable it was.
- What do Skill scanners catch without an LLM? A small, reproducible test (part 1)
I planted 18 flaws and 6 harmless controls in sample AI-agent Skills and ran two open-source scanners in Docker. Here is what they caught, missed and falsely flagged with no LLM stage, and the repo to rerun it. Part 2 adds a local LLM judge.
- Closing Systemic Cloud Risk at Scale: A Practitioner's Framework for Regulatory-Driven Security Remediation in Financial Services
A four-phase framework — target-state threat modeling, single accountable ownership, governed migration, and repeatable control testing — for closing systemic cloud and AI security gaps in regulated financial institutions.
- Starting this blog
Why I'm writing about cloud and AI security, and what to expect here.