Insights
Security
Penetration testing, application and cloud security, AI/LLM red teaming and compliance — practical, from engineers who ship.
Security
Security ·
Cyber Resilience Act reporting is live: what to build before your first 24-hour clock starts
Since 11 September 2026 every manufacturer selling software or connected products in the EU must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform within 24 hours. The law is short; the hard part is the pipeline that tells you, inside that window, what you ship and whether it is being exploited.
8 min read
Security ·
MCP Servers in Production: How We Vet and Lock Them Down
Inventory every MCP server first, authenticate each caller with a token issued for that exact server, sandbox anything that runs locally, and log every tool call. Most 2026 MCP incidents trace back to configuration and defaults, and the 28 July 2026 spec revision adds a migration on top.
9 min read
Security ·
SealedRun: Tamper-Evident Audit Trails for AI Agents
Agent traces stored in your own database are claims, not evidence: whoever runs the store can edit it. SealedRun, an early-stage open-source recorder, signs every agent step into a hash chain that an outsider can verify offline. Here is how it works, what it proves, and how we run it for our own agents.
9 min read
Security ·
OWASP Top 10 for LLM applications, explained for people who ship them
The 2025 list names ten ways an LLM app gets attacked. Here is what each one looks like in a real chatbot, RAG system or agent — and the fix we apply in production.
4 min read
Security ·
Penetration test or vulnerability scan: which one to order, and when
Customers ask for a "pentest" and often mean a scan; vendors sell a scan and call it a pentest. What each really is, what it costs in time, and a schedule that works for a product team.
4 min read
Security ·
Securing AI agents in production: seven controls we never skip
An agent that can read your CRM and send emails is an employee with no judgement and infinite patience for a well-written attack. The controls that let us connect agents to real systems without losing sleep.
4 min read