Sign in

Adrian Mouat

@adrianmouat.com
1K followers 543 following 744 posts

Technical community advocate at Chainguard. Bad guitarist. He/him.

PostsRepliesMedia
Adrian Mouat @adrianmouat.com · 14/09/2026
Remember, if it takes over your roomba, you can just unplug it.
daleks are foiled by a set of stairs
230
Adrian Mouat @adrianmouat.com · 11/09/2026
When using AI I keep coming back to this Peter Drucker quote: "There is surely nothing quite so useless as doing with great efficiency what should not be done at all"
101
Adrian Mouat @adrianmouat.com · 08/09/2026
I've used this graph in slides recently, and only just realised how misleading it is. Apologies to anyone I have in turn misled. zerodayclock.com have now changed their graphs.
100
Adrian Mouat @adrianmouat.com · 08/09/2026

Why do you not publish a time to exploitation metric?
Because it fails in three separate ways, and each of them flattens the line for reasons that have nothing whatever to do with attacker behaviour.

First, and most importantly, it ignores aging. The metric compares years that have had wildly different amounts of time in which to accumulate evidence. A vulnerability published six years ago has had six years in which somebody might notice it being exploited, whereas one published last quarter has had a few weeks. Recent years therefore look artificially fast and older years look artificially slow, and a large part of any trend you draw through them is simply the passage of time rather than a change in the world.

Second, it saturates. Time to exploitation is floored at zero. Once a large share of exploitation is landing on the day of publication, the metric has nowhere left to go and cannot represent any further acceleration. A vulnerability exploited quietly for months before anybody knew it existed and one exploited on the morning of disclosure both record the same value, which is to say the metric stops being able to tell apart the two situations that matter most.

Third, the next real change would move both ends at once, and an average cannot show that. As the cost of finding and weaponising a vulnerability falls, we would expect to see more exploitation arriving at or before disclosure, and at the same time more exploitation of the long tail of older vulnerabilities that was previously protected by nothing more than attacker labour cost. That tail is already where a great deal of the damage sits. Mass moving toward zero and a tail growing fatter offset one another inside a mean, so the number could sit perfectly still while both halves of the distribution moved.

We are not claiming that this shift has already happened. We are saying that a time to exploitation metric could not tell you whether it had, and that on its own is reason enough to stop using it.
100
Adrian Mouat @adrianmouat.com · 04/09/2026
This week I read a blog post by @anil.recoil.org . In it he describes creating a PR for an OCaml library to fix a security issue -- minutes later his own webserver is being probed for the vulnerability.
100
Adrian Mouat @adrianmouat.com · 03/09/2026
If you're at @containerdays.bsky.social and interested in surviving the 🌋vulnpocalypse🌋 that is now upon us, come to my talk at 9.30 in Room 4. Which is handily near the @chainguard.dev booth.
000
Adrian Mouat @adrianmouat.com · 28/08/2026
AI Agents often fail the "Jurrasic Park" test: they become obsessed with what they can do and forget to think about if they "should". To everyone using AI right now -- please keep at least half an eye on *how* your agents are completing tasks. (Credit to @chainguard.dev CTO Matt Moore for this!)
110
Adrian Mouat @adrianmouat.com · 29/07/2026
Thoughts on the wp2shell Wordpress hack
031
Adrian Mouat @adrianmouat.com · 06/07/2026
I'll be at WeAreDevelopers in Berlin this week if anyone wants to say hi! Or listen to me talk about vulnpocalypses.
110
Adrian Mouat @adrianmouat.com · 05/06/2026
This week, Elad Meged found a critical exploit in the Gemini CLI. He wrote: "This is the type of exploit that turns CI/CD pipelines into supply-chain attack paths." novee.security/blog/google-...
200
Adrian Mouat @adrianmouat.com · 01/06/2026
State Of Open Con is coming to Edinburgh this Friday! There's a pretty amazing speaker lineup (and then there's me, but you can't have everything), so please do come join us. Free tickets are available for community, students and anyone in-between jobs. stateofopencon.com/edinburgh-so...
041
Adrian Mouat @adrianmouat.com · 29/05/2026
Bruce Schneier wrote (or paraphrased): If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology. His point was that security is a process, not a product. It lies in the interaction and intersection of systems.
100
Adrian Mouat @adrianmouat.com · 22/05/2026
A few weeks ago Sam Altman said: "We see a future where intelligence is a utility like electricity or water and people buy it from us on a meter and use it for whatever they want to use it for" www.businessinsider.com/sam-altman-a...
101
Adrian Mouat @adrianmouat.com · 14/05/2026
I'll be speaking at SOOCon 26 on the Road in Edinburgh on 5th June. I'll be joining Andy Martin and @lizrice.com for a fireside chat on "The Mythos Effect", and how things might never be quite the same again... Tickets: stateofopencon.com/edinburgh-soocon26
020
Adrian Mouat @adrianmouat.com · 11/05/2026
I'm happy to be back in the ambassador game, this time as part of @openuk.bsky.social. OpenUK has been doing a fantastic job championing open source software, hardware, data, AI, and open standards to help grow the UK's digital economy.
000
Adrian Mouat @adrianmouat.com · 17/02/2026
My hot take on why the "latest" tag is sometimes the best tag to use! #containers #kubernetes #devops
120
Adrian Mouat @adrianmouat.com · 06/02/2026
For those of us struggling with feeling devalued as programmers with the rise of AI, I present the following quote from Paul Graham: "In programming, as in many fields, the hard part isn't solving problems, but deciding what problems to solve."
131
Adrian Mouat @adrianmouat.com · 02/02/2026
She loves it, so I guess it was worthwhile!
010
Adrian Mouat @adrianmouat.com · 02/02/2026
The ice dispenser "works"
010
Adrian Mouat @adrianmouat.com · 02/02/2026
Probably the most complex piece of self assembly furniture I've ever built was my kids toy kitchen.
Ridiculously complicated kids toy kitchen with oven, hob, microwave, fridge, sink and cupboards
230
Adrian Mouat @adrianmouat.com · 27/01/2026
Stockholm, I have entered your maw. I'm also talking at the cncf Meetup tonight if anyone is interested! community.cncf.io/events/detai...
View going down an escalator into Stockholm train station. It's deep and slightly alienating
060
Adrian Mouat @adrianmouat.com · 23/01/2026
@danlorenc recently wrote a blog on Gastown, which is Steve Yegge's attempt to build a "workspace manager" for coordinating AI agents. www.chainguard.dev/unchained/ga...
110
Adrian Mouat @adrianmouat.com · 22/01/2026
@chainguard.dev Assemble returns! Chainguard's flagship conference is coming to NYC. Come join us in March for talks & community events on the future of secure software (and especially secure container images). assemble.chainguard.dev/event/2991fc...
010
Adrian Mouat @adrianmouat.com · 21/01/2026
I'm sure some of you use the excellent @renovatebot.com to update dependencies in repos. But if you're calling Renovate from a GitHub action, you probably had to create a Personal Access Token (PAT). And PATs are a form of long-live token, my thoughts on which are summed up by this GIF.
120
Adrian Mouat @adrianmouat.com · 16/01/2026
Apparently Dijkstra wrote: "If in physics there's something you don't understand, you can always hide behind the uncharted depths of nature. You can always blame God. You didn't make it so complex yourself."
110
Adrian Mouat @adrianmouat.com · 13/01/2026
The most important one being "avoid long-lived credentials". Oh, and I love the 12-factor app manifesto, but please don't put secrets in env vars! See the comments for a link to the full presentation.
000
Adrian Mouat @adrianmouat.com · 09/01/2026
Evaluating risk and focusing on actual problems is key to security. Quantum risks are real, but does it matter when you leave long-lived tokens accessible? As Bruce Schneier said "More people are killed every year by pigs than by sharks, which shows you how good we are at evaluating risk."
020
Adrian Mouat @adrianmouat.com · 22/12/2025
I have found the original inspiration for space invaders
000
Adrian Mouat @adrianmouat.com · 12/12/2025
"Any fool can write code that a computer can understand. Good programmers write code that humans can understand." I stumbled across this quote from Refactoring by Martin Fowler when looking at dannorth.net/blog/cupid-f... by @tastapod.com .
"Any fool can write code that a computer can understand. Good programmers write code that humans can understand."
192
Adrian Mouat @adrianmouat.com · 28/11/2025
At a private event last week Bogomil Balkansky shared his thoughts on what he looks for when investing and advising companies.  The quote that stuck with me was "Velocity is the primary determinate of success for a company".
110
Adrian Mouat @adrianmouat.com · 21/11/2025
When I've had to explain what containers are in the past, I've often used this quote from @bcantrill.bsky.social  "Docker will do to apt what apt did to tar."
110
Adrian Mouat @adrianmouat.com · 10/11/2025
@puerco.mx kicking off Open Source SecurityCon by demonstrating how to prevent cats messing with your training data.
181
Adrian Mouat @adrianmouat.com · 07/11/2025
Continuing quote Friday, here's one from Werner Herzog when a journalist asks him about teaching his son "real things": ‘It’s much easier than that. Your son doesn’t need to know how to milk a cow. I’d allow him to dig a deep hole in the ground. Just let him dig a hole in the ground.’
110
Adrian Mouat @adrianmouat.com · 06/11/2025
On Wednesday, during the booth crawl, I will be taking part in the biggest event at KubeCon. Alongside the one-and-only (thankfully) @bretfisher.com , we will be hosting "The CVE Price is Right" at the Chainguard booth. Come along to win amazing prizes (Bret's broken juicer)!
220
Adrian Mouat @adrianmouat.com · 03/11/2025
The product page has even more business numbers you can twiddle with! www.chainguard.dev/containers
000
Adrian Mouat @adrianmouat.com · 03/11/2025
If you've visited the @chainguard.dev  Images page recently you might have noticed there's a fun new calculator which estimates how much $$$ you could save by moving to our images and thereby eliminating CVE remediation tasks.
110
Adrian Mouat @adrianmouat.com · 24/10/2025
One of my favourite movie quotes: "You, me, or nobody is gonna hit as hard as life. But it ain't about how hard ya hit. It's about how hard you can get hit and keep moving forward. How much you can take and keep moving forward. That's how winning is done!"
120
Adrian Mouat @adrianmouat.com · 22/10/2025
Great demo recreation starring @matts.net as the voice of Claude
020
Adrian Mouat @adrianmouat.com · 22/10/2025
Now we have @wiggitywhitney.bsky.social telling us how to trust a liar. Or creating a journal application with Claude code and open telemetry.
161
Adrian Mouat @adrianmouat.com · 22/10/2025
Anyone can give a talk!
100
Adrian Mouat @adrianmouat.com · 22/10/2025
@mccune.org.uk is next up at @kcduk.bsky.social talking about, err, talks
140
Adrian Mouat @adrianmouat.com · 22/10/2025
Day 2 of @kcduk.bsky.social and @lianmakesthings.bsky.social is explaining how platform engineering replaced the DevOps walk of confusion with a canyon of confusion.
031
Adrian Mouat @adrianmouat.com · 21/10/2025
Some of the problems with the git part of GitOps
000
Adrian Mouat @adrianmouat.com · 21/10/2025
Now we have Jake Klein and Chunyi Lyu talking about how Kratix builds on top of GitOps. @kcduk.bsky.social
100
Adrian Mouat @adrianmouat.com · 21/10/2025
Flagger for progressive delivery
000
Adrian Mouat @adrianmouat.com · 21/10/2025
Flux rewrite in 2020 for modularity, extensibility and security.
100
Adrian Mouat @adrianmouat.com · 21/10/2025
@stefanprodan.com kicks off track 1 at @kcduk.bsky.social with a talk on GitOps and Flux
351
Adrian Mouat @adrianmouat.com · 21/10/2025
@hannahfoxwell.net continues the @kcduk.bsky.social keynotes by telling us how GenAI is redefining software development.
Hannah Foxwell standing next to a slide reading GenAI is Redefining Software Development
120
Adrian Mouat @adrianmouat.com · 21/10/2025
@mt165.co.uk it's talking about trade and geography in Scotland. But he showed a map of Scotland without Shetland. Which is basically a diplomatic incident as far as I'm concerned.
141
Adrian Mouat @adrianmouat.com · 21/10/2025
@lizrice.com kicks off @kcduk.bsky.social by telling us about the business of open source software. It's free like a puppy can be free!
Liz Rice speaking in front of a crowd. The slide shown behind her has a picture of a small cute dog
120