Posts
All the articles I've posted.
Bulletproof Hosting Watch: Week of 2026-09-21
Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.
Jev: Decisions > Essays, And A Glimmer Of Hope For Defenders
TypeSafe's Jev returns typed, calibrated decisions instead of prose — and that makes alert triage, phishing detection, and deception-fleet work automatable.
PQProbe Vendor Analysis: Where 100 Cybersecurity Vendors Actually Stand on Post-Quantum TLS
PQProbe v3.7.5 Enterprise Edition measured 100 cybersecurity vendors. 67 apexes negotiate post-quantum key exchange, but 79.8% of that lives behind third-party edges while only 23.5% lives on first-party infrastructure. A census of the Cyber 100.
Bulletproof Hosting Watch: Week of 2026-09-14
Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.
What 100 cybersecurity vendors do about TLS and DNS: post-quantum 👍🏼, DNSSEC 🔴
67 of 100 cybersecurity vendors support post-quantum key exchange, but 75% leave DNS unsigned and not one publishes a TLSA record. A census of the Cyber 100 across TLS and DNS posture.
Bulletproof Hosting Watch: Week of 2026-09-07
Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.
What 100 Cybersecurity Vendors Tell AI Agents: An llms.txt Census
I probed all 100 Cyber 100 cybersecurity vendors for /llms.txt: 34 ship one, 40 return 404, and eight WAFs block it outright — including Cisco, which seems to require TLS fingerprint matches to user-agents. A census of what the security industry actually tells AI agents, plus what a good llms.txt should carry (and what to leave out).
Somebody Is Hunting For Your AI API Keys With A Fake GrokBot User-Agent
Six Google Cloud VMs rotated through a honeypot fleet over six days, stole 53 canary AWS credentials, and tried to spend them on Amazon Bedrock's cheapest model within ten seconds of each theft. The stolen credential playbook is new. The identity spoof it depends on is not. If you run anything that serves files over HTTP and holds AI provider keys in environment variables, read this.
Bulletproof Hosting Watch: Week of 2026-08-31
Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.
A Scanner Named ARWP: Tracing a Curious User Agent Back to Its Source
I traced an unknown user agent (arwp-scanner/0.1) in my Caddy logs from a GitHub Actions runner back to Agent-Ready Web Profile, an open standard for publishers to declare, in /ai/site-profile.json, how agents may read a site — and I explain why I'll publish one.