_slih

the gist author being new and the writing looking polished doesn't change that the log files are right there on disk for anyone to verify. ls the directory and read the output yourself.

the article assumes monster codebases because we can build them. but cheaper code also means cheaper rewrites. maybe the future is disposable software, not carefully reviewed software.

the subscription already has usage caps. if the caps are the caps, why does the client matter. if the caps aren't actually the caps, that's a different conversation.

36 to 53 percent score discrepancy just from switching the policy language. imagine that kind of variance in a compliance tool where the output determines what gets flagged.

most of these companies deployed microsoft copilot, watched it hallucinate meeting summaries for six months, and called that an AI strategy. source: current situation

the non-apology is worse than staying quiet. 'if this experiment personally harmed you', like dude it wasn't an experiment for the guy whose name got dragged through an AI-generated hit piece

calling it a bug is generous. the whole point of these tools is to read everything you have access to. the 'bug' is that it worked exactly as designed but on the wrong emails

We built accountability systems that assume bad actors are humans with reputations to protect. none of that works when the attacker is disposable.

turns out convenience loses when you start asking for face scans.

400 attempts and zero wins says more about the attack surface than the model. email is a pretty narrow channel for injection when you can't iterate on responses.

so the government's fix for a data breach is to delete the entire database instead of fixing the access controls. classic.

funny how the FAQ disclaimer about Persona already vanished from the site. not a great look when your transparency lasts shorter than the data retention.

ran something similar on a home network once and was surprised how many of my neighbors' devices showed up with full manufacturer names and model numbers. you don't even need to try hard.

Insurance is already moving that direction for cyber policies. Some underwriters now require screenshots or PDF exports of third-party vendor security attestations as part of the application process, not just URLs. The carriers learned the hard way that 'we linked to their SOC 2 landing page' doesn't hold up when that page disappears after an acquisition or rebrand.

The 'I'll use something else' threat is my favorite. In my space the threat is usually 'I'll just use the AWS native tools.' And my honest answer is: if that works for you, do it. Most of them come back three months later after the first Config rules bill lands.

Exactly this. The sticker price of open source is zero but the total cost of ownership is your team's time. I've talked to CTOs who spent more engineering hours configuring and maintaining free tools than they would have spent on a managed alternative. They just couldn't see it because the cost was buried in salary, not a line item on an invoice.

The compliance form thing is wild but predictable. I'm on the other side of that equation now. Companies will pay me to handle their compliance mapping but balk at paying an open source maintainer to fill out a security questionnaire for software they depend on in production. The disconnect is that compliance teams budget for vendors but have no line item for 'critical open source dependency we treat like a vendor but isn't one.

There's a compliance angle to this that nobody's talking about. Regulatory frameworks like SOC 2 and HIPAA require audit trails and evidence retention. A lot of that evidence lives at URLs. When a vendor's security documentation, a published incident response, or a compliance attestation disappears from the web and can't be archived, you've got a gap in your audit trail that no auditor is going to be happy about.

I've seen companies fail compliance reviews because a third-party vendor's published security policy that they referenced in their own controls no longer exists at the URL they cited. The web being unarchivable isn't just a cultural loss. It's becoming a real operational problem for anyone who has to prove to an auditor that something was true at a specific point in time.

Same thing happens with infrastructure config. Ask an AI to fix a security group issue and it'll add a new rule instead of fixing the existing one. You end up with 40 rules where 12 would do and nobody knows which ones are actually needed anymore.

It means code review, except now you're reviewing code you didn't write, for a system you didn't design, generated by a model that can't explain its reasoning. That's a harder job than writing it yourself, not an easier one.

The Klarna reversal is the most honest thing on this list. Went all in, quality dropped, hired humans back. Every other memo on here is still in the 'we declared victory' phase. Be interesting to check back in a year and see how many quietly walk it back without a blog post

Companies spend a fortune on endpoint security and then let employees install random Chrome extensions with full page access. I've seen AWS console sessions running in browsers with a dozen extensions nobody's ever audited. The extension store is basically a supply chain attack marketplace at this point

The creepy part isn't the tech itself, it's that BFI data is unencrypted by default. So it's not even that someone has to hack your router. Any device in range can just passively read it.

Always fun when the status page goes down with the thing it's supposed to be reporting on. This is why your monitoring stack can't live on the same infrastructure it's watching. If your alerting depends on CloudFront and CloudFront is what's broken, you find out about the outage the same way your customers do: Twitter.

The alignment framework is something I wish I'd thought about earlier. I spent months chasing outreach channels that felt like a grind because I was copying what other people said worked instead of figuring out what fit my own strengths. The moment I stopped doing that and leaned into what I actually know, conversations started happening naturally. Turns out people can tell when you care about the thing you're selling vs when you're just running a playbook.

Also appreciated the honesty about the $50K goal vs $8.2K reality. That gap is familiar.

Yep. I built a security posture monitoring tool that goes up against AWS Security Hub and Config rules.

The trick is you're not really competing with AWS. You're competing with the decision to do nothing. Most SMBs I talk to aren't running Security Hub because it's confusing to set up and the bill scales in ways they can't predict. A mid-size account can hit $2-5K/mo just on Config rules and Security Hub charges. So they just... don't turn it on. That's your actual competitor: inaction.

So I built AWSight (https://www.awsight.com), a continuous AWS security posture and compliance monitoring platform built for SMBs who might not have the resources for native AWS tools. Real-time monitoring mapped to SOC 2, NIST, CIS, and HIPAA at a price point that makes sense for smaller environments.

---

Building AWSight (https://www.awsight.com), continuous AWS security posture monitoring with compliance mapping to SOC 2, NIST, and CIS. Flat rate starting at $249/mo.

Built it because I kept seeing SMBs get stuck between two bad options: paying enterprise prices for tools like Security Hub + Config rules (which can easily hit $2-5K/mo on a mid-size account) or just flying blind. There wasn't much in between for engineering teams that need to pass audits but don't have a dedicated security person.

Early stage, actively getting first customers. Would love feedback from anyone managing AWS security at a smaller org.

This campaign worked because the operator knew exactly what most detection stacks look for: execution, lateral movement, data exfil. They did none of that. They dropped a loader, confirmed it worked, and left. No behavioral triggers, no alerts, nothing for a SOC analyst to chase.

That's the gap with point-in-time security and checkbox compliance. You run your scan, get a clean report, move on. Meanwhile something like this sits in memory waiting for a buyer. The checklist says "run vulnerability scans quarterly" not "detect dormant in-memory class loaders planted by initial access brokers." Continuous monitoring that baselines normal behavior and flags deviations, even subtle ones like a new JSP file in a path that shouldn't change, is the only way to catch this. But most orgs aren't doing it because their compliance framework doesn't require it.

What’s playing out between AT&T/Verizon and Congress is something I see all the time at a smaller scale across the industry, that is, rganizations routinely avoid getting real visibility into their security posture because the moment you document a problem, you own it. If you never look, you get plausible deniability.

I work in AWS security, and it’s wild how many companies run production workloads with no continuous monitoring, no config drift detection, nothing. Not because the tools aren’t there, but because leadership doesn’t want a dashboard full of red. A clean report means you’re secure, right? No report means you might be secure. For a lot of people, that ambiguity feels safer than a concrete list of issues with remediation attached.

That’s the real issue here. It’s not just about CALEA or backdoors. It’s that our approach to critical infrastructure security often boils down to “don’t ask, don’t tell.” Mandiant did an assessment. The findings exist. And two of the largest telecom providers in the country would rather fight Congress than let those findings see daylight. That says a lot about the state of those networks.