Security projects with outputs you can use: templates, worksheets, checklists and code. Each one tracks its status and links to the blog posts written about it. Code lives on GitHub where applicable.
Active
A playbook for the first security hire or the engineering leader who owns security by default: what to do in the first 90 days, how to build a roadmap ranked by business risk, what to buy and what to build, when compliance arrives, and how to report progress leadership can act on.
Active
Service accounts, CI/CD runners, API keys and now AI agents outnumber the people in most organisations, and few of them have an owner. A practical governance model built on inventory, human ownership, least privilege and short-lived credentials that works across clouds and SaaS.
Active
What changes in an application security programme when a growing share of code is written by AI assistants: leaked secrets, hallucinated dependencies and missing authorisation checks. Plus a pre-merge guardrail set that catches them without slowing engineers down.
Active
A vendor-neutral catalogue of controls for agents that call tools through the Model Context Protocol. It covers tool poisoning, confused-deputy access, weak server authentication and over-privileged credentials, organised by where each control sits in the life of a tool call.
Active
A practical method for threat modelling anything built on a language model, from a single chat feature to agents that plan, call tools and keep memory. It combines STRIDE, CSA's MAESTRO layers and the OWASP Top 10 for Agentic Applications into one worksheet a product team can actually run.
