Blog
Mechanisms, never client cases.
What we find, how it works and how to fix it. Written for the engineers who have to fix it, and anonymized so no client can be recognized.
- Your agent reads the web. So does the attacker.How retrieved content becomes actions your agent takes, and what actually limits the damage.
- The riskiest access in your cloud is the one nobody ownsPermissions that outlived the reason they were granted, and how to keep them from coming back.
- Click rate is the wrong numberWhat a phishing simulation should measure, and why the common metric rewards the wrong behavior.
- We skipped a startup’s paid subscription by changing one field in SupabaseA regular account could change the attribute that defined its privileges.
Get in touch
Is there something you are worried about?
Tell us what you are building and what you need to decide.
What happens next
- 01
You tell us what you are building
Four short questions, or a plain email. No deck needed.
- 02
A person reads it and replies
With an honest first view and the questions we need answered to scope it.
- 03
A 30-minute scoping call
Live or async, as you prefer. We agree on what is in scope and you get the fixed price in writing before any work begins.