Knowledge Base
Security & cryptography guides
33 guides across 6 topics. Each article explains the concept, shows concrete examples or configuration, and lists the primary sources it relies on. Pick a topic hub for a suggested reading order, or search below.
Articles
- Agentic AI • 4 min readAI Agent Identity and Authorization: Credentials, Delegation and Least PrivilegeHow to give agents their own identities, use short-lived scoped tokens, delegate on behalf of users safely, and enforce permissions in the tools rather than in prompts.
- Generative AI • 3 min readAI Supply Chain Security: Models, Datasets and Safe SerializationWhy downloading a model is like running untrusted code, the risks in pickle-based model files, how to verify provenance, and how to build an AI bill of materials.
- Post-Quantum Cryptography • 3 min readBuilding a Cryptographic Inventory (CBOM): A Practical MethodHow to discover and record every place your organization uses cryptography, using code scanning, network discovery and certificate data, and how a CBOM differs from an SBOM.
- Generative AI • 4 min readCost and Abuse Controls for LLM APIs: Rate Limits, Budgets and Denial-of-WalletHow to protect an LLM-backed application from runaway spending and abuse using layered limits, authentication, quotas, caching, input caps and monitoring, with a serverless example.
- Post-Quantum Cryptography • 3 min readCrypto-Agility: Design Patterns for Swappable CryptographyConcrete patterns for building systems that can change algorithms without rewrites: abstraction layers, algorithm identifiers, versioned envelopes, dual-write rotation and policy as configuration.
- Generative AI • 4 min readData Privacy When Using Generative AI at Work: A Practical Policy GuideWhat happens to data you send to AI tools, the main privacy risks (leakage, retention, training use, shadow AI), and how to write an acceptable-use policy employees will follow.
- Agentic AI • 4 min readEvaluating and Testing AI Agents: From Test Suites to Regression GatesHow to test systems whose behavior varies from run to run: building task datasets, scoring outcomes and tool use, handling non-determinism, and running evaluations in CI.
- Generative AI • 3 min readFine-Tuning vs RAG vs Prompting: How to ChooseA decision guide for adapting a language model to your needs: what each approach changes, costs, data and privacy implications, and a simple order of operations.
- Generative AI • 4 min readGoverning Generative AI: NIST AI RMF and the EU AI Act in Plain LanguageWhat the NIST AI Risk Management Framework and the EU AI Act ask of organizations, how they differ, the current timeline (including the 2026 delays), and a lightweight governance program for a small company.
- Post-Quantum Cryptography • 3 min readHarvest Now, Decrypt Later: The Quantum Threat That Already Applies TodayWhy encrypted data captured today can be a liability years from now, how to judge whether your data is at risk, and which mitigations actually reduce exposure.
- Agentic AI • 3 min readHuman-in-the-Loop Design for AI Agents: Approvals That People Actually ReadHow to decide which agent actions need approval, how to design approval prompts that prevent mistakes instead of causing click fatigue, and how to measure whether oversight works.
- Post-Quantum Cryptography • 3 min readHybrid TLS in Practice: X25519MLKEM768 ExplainedHow hybrid post-quantum key exchange works in TLS 1.3, why X25519MLKEM768 became the default, what it costs in bytes, and how to enable and verify it.
- Generative AI • 4 min readLLM Hallucinations: Why They Happen and How to Reduce ThemWhat hallucinations are, why language models produce confident falsehoods, the practical mitigations (grounding, verification, constrained output), and the security angle of invented software packages.
- Agentic AI • 4 min readModel Context Protocol (MCP) Security: Risks of Connecting Agents to ToolsWhat MCP is, the main attack classes against MCP servers and clients (tool poisoning, rug pulls, confused deputy, token passthrough), and a checklist for vetting and running servers safely.
- Agentic AI • 3 min readMulti-Agent Systems: Patterns, Failure Modes and Trust BoundariesCommon multi-agent architectures (orchestrator-worker, pipeline, debate), why they fail in practice, and how to set trust boundaries so one compromised agent cannot take over the rest.
- Agentic AI • 3 min readObservability and Audit Logging for AI AgentsWhat to capture in agent traces, how to correlate steps, redact sensitive data, set retention, and use logs for debugging, security investigations and compliance evidence.
- Post-Quantum Cryptography • 3 min readPost-Quantum Digital Signatures: ML-DSA and SLH-DSA ComparedHow FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) differ, their key and signature sizes, where signatures matter most (code signing, PKI, firmware), and how to plan migration.
- Generative AI • 4 min readRetrieval-Augmented Generation (RAG) Explained: Chunking, Embeddings and RerankingHow RAG systems work end to end, the design choices that decide answer quality (chunking, embeddings, hybrid search, reranking), how to evaluate retrieval, and the security controls to build in.
- Application & API Security • 3 min readSecrets Management: Preventing and Responding to Hardcoded CredentialsWhy secrets leak, how to detect them with scanning and push protection, what to do within the first hour of a leak, and how to design systems that keep secrets out of code.
- Cloud Security & Compliance • 3 min readSOC 2 Evidence Automation: Moving from Annual Scramble to Continuous ReadinessWhat SOC 2 evaluates, the difference between Type I and Type II, which evidence can be collected automatically from cloud and CI/CD systems, and how to run a continuous program.
- Application & API Security • 3 min readThe OWASP API Security Top 10 (2023): A Practical GuideEach of the ten API risks explained with a realistic example and a concrete defense, plus a prioritization guide for small teams.
- AI & LLM Security • 3 min readThe OWASP Top 10 for LLM Applications: A Practical GuideThe ten risk categories for LLM-based applications in the 2025 OWASP list, each with a short example and the most effective mitigation.
- Agentic AI • 3 min readWhat Is an AI Agent? Architecture of Planner, Tools, Memory and the Control LoopA clear explanation of how AI agents differ from chatbots and fixed workflows, the components every agent has, and when an agent is the wrong choice.
- Application & API Security • 3 min readAutomating API Security Linting in CI/CDWhat API security linting is, which checks catch real vulnerabilities, how to add it at pre-commit and pull-request stages, and how to keep false positives under control.
- Application & API Security • 3 min readBusiness Logic Vulnerabilities: How They Work and How to Prevent ThemWhy flaws in workflow rules evade scanners and firewalls, with concrete examples (price tampering, coupon races, step skipping) and server-side patterns that prevent them.
- Application & API Security • 3 min readRunning Security Scanners as a GitHub Action: Setup, Permissions and PitfallsA practical guide to running security scanning in GitHub Actions safely: least-privilege tokens, pinning actions to commit SHAs, fork pull request behavior, SARIF reporting and secret handling.
- AI & LLM Security • 3 min readAI-Assisted Code Review and Automated Remediation in CI/CDHow to combine static analysis with LLM reasoning to find and fix vulnerabilities in pull requests, where AI helps, where it fails, and how to keep it safe and accurate.
- AI & LLM Security • 3 min readBuilding Secure Agentic AI Workflows: Tools, Permissions and MemorySecurity design for AI agents that call tools and APIs: capability scoping, sandboxing, approval gates, vector store isolation, audit logging and runaway-cost controls.
- AI & LLM Security • 4 min readDefending LLM Applications Against Prompt Injection and Data ExfiltrationDirect and indirect prompt injection explained with examples, the exfiltration paths attackers use, and layered defenses that reduce impact when injection cannot be fully prevented.
- Post-Quantum Cryptography • 4 min readDemystifying ML-KEM: How NIST's Post-Quantum Key Exchange WorksA plain-language explanation of ML-KEM (FIPS 203): the lattice problem behind it, how key encapsulation works, parameter sets and sizes, and what changes for engineers.
- Cloud Security & Compliance • 3 min readIAM Hardening for AWS Lambda: Least Privilege in PracticeHow to scope Lambda execution roles to exact actions and resources, use conditions and permission boundaries, validate policies with Access Analyzer, and handle secrets safely.
- Post-Quantum Cryptography • 3 min readStep-by-Step Guide: Migrating from RSA and ECDH to ML-KEMA phased engineering roadmap for moving key exchange from RSA/ECDH to hybrid and then ML-KEM: inventory, prioritization, pilots, rollout, monitoring and rollback.
- Post-Quantum Cryptography • 3 min readThe NIST Post-Quantum Standards Era: What Security Leaders Need to KnowAn executive overview of FIPS 203, 204 and 205, the draft NIST IR 8547 transition timeline, and a practical plan for budgeting and governing a cryptographic migration.