Reposted by GrahamCyberLens AI @cyberlensai.bsky.social · 15hBuilt a scanner because I kept shipping the same three mistakes. Now I catch the same three mistakes in other people's products. The market for security tooling is mostly people confessing to themselves at scale. 021
Graham @cirriustech.co.uk · 7hJEV is fast, cheap and surprisingly capable. But recent research into its decision logic raises a bigger question: what happens when probabilistic AI judgment becomes an automated security control? #ai #agentic-security #security-operations #threat-intelligence #jevcirriustech.co.uk"High Confidence" Is Not a Security ControlJEV is fast, cheap and surprisingly capable. But recent research into its decision logic raises a bigger question: what happens when probabilistic AI judgment becomes an automated security control? 110
Graham @cirriustech.co.uk · 21hI needed a new obscure RFC to wind people up with cos they know about HTTP 418… So… www.rfc-editor.org/info/rfc3514/ 😂rfc-editor.orgRFC 3514: The Security Flag in the IPv4 Header | RFC EditorFirewalls, packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. We define a sec... 000
Graham @cirriustech.co.uk · 01/10/2026Not me, writing a wrapper script for jFrog Boost ui for my raspberry pi to forward the dynamic port so I can view the boost web ui on my iPhone, as I do most of my agentic dev there, then having to also rewrite headers cos they added a host header set to localhost. 010
Reposted by GrahamHolly Brockwell @hollyqueenofspayeds.com · 01/10/2026If I ever win the lottery, I won't tell anyone, but there will be signs 51278
Graham @cirriustech.co.uk · 01/10/2026static.klipy.comRafael Barba: I MEAN... (Law & Order SVU)ALT: Rafael Barba: I MEAN... (Law & Order SVU) 110
Graham @cirriustech.co.uk · 01/10/2026Sharing my repro code repo for this: github.com/goldjg/SOCWh...github.comGitHub - goldjg/SOCWhispererContribute to goldjg/SOCWhisperer development by creating an account on GitHub. 041
Graham @cirriustech.co.uk · 30/09/2026MSRC assessed an indirect prompt injection into Security Copilot as Low severity because consequential action still required downstream automation or human approval. That rationale gets much more absurd once security systems are explicitly designed to perceive, reason, and act autonomously.cirriustech.co.uk'A Human Should Check It' is Not an Agentic Security ControlMSRC assessed an indirect prompt injection into Security Copilot as Low severity because consequential action still required downstream automation or human approval. That rationale gets much more … 121
Graham @cirriustech.co.uk · 30/09/2026Does that make it not a legal document? In the United States? 010
Reposted by GrahamCiaran Martin @ciaranm.bsky.social · 29/09/2026I was wrong. It’s happening 222044244
Graham @cirriustech.co.uk · 29/09/2026I’m fine dude just throwing shade at the Frontier AI cybercrime labs LOL 110
Graham @cirriustech.co.uk · 29/09/2026Tbh I wasn’t sure it would work well and let’s face it I am not the one to try to explain in the style of kubernetes, least of all you! But it made sense to me so… 010
Graham @cirriustech.co.uk · 29/09/2026Look if Ian is ok with it then that’s literally the only thing that matters 100
Graham @cirriustech.co.uk · 24/09/2026static.klipy.comAudience Clapping and ApplaudingALT: Audience Clapping and Applauding 010
Graham @cirriustech.co.uk · 24/09/2026MSRC: Status - ADDITIONAL_INFORMATION_NEEDED Also MSRC: Not tellin ya what info we want tho lolstatic.klipy.comShe-Ra's Psychic GazeALT: She-Ra's Psychic Gaze 000
Reposted by GrahamDr. Sarah Parcak @indyfromspace.bsky.social · 19/09/2026I bet they'll do a gang bang up job 0416
Graham @cirriustech.co.uk · 18/09/2026I spend too much time thinking about the fact there’s a Workload Identity Premium licence but no Workload Identity Standard licence 010
Graham @cirriustech.co.uk · 17/09/2026Since iOS 27, the overlay text shortcut action won’t let me pick a font for the text. Tap on System to pick a font other than system does nothing. Existing shortcuts that have a font other than system still honour the selected font. Anyone else seeing this or found a fix/workaround? 000
Graham @cirriustech.co.uk · 17/09/2026static.klipy.comDaniel Kaluuya Laughing Hysterically at PhoneALT: Daniel Kaluuya Laughing Hysterically at Phone 110
Graham @cirriustech.co.uk · 16/09/2026The curious case of a control that’s supposed to cause near real-time evaluation of the access a user has so that risky access or even just disabled accounts lose access quickly, doesn’t trigger for a mobile app & Microsoft says it’s not a priority to fix because… the user already has access…cirriustech.co.ukContinuous Access Evaluation: Is it really tho?An investigation into Outlook Mobile continuing to access Exchange Online mailbox data after Conditional Access and Continuous Access Evaluation say the session should no longer be authorised. 020
Graham @cirriustech.co.uk · 14/09/2026Good news! Your favourite progressive webapp for MVP Conference Attendance tracking still works with iOS 27! wheremymvps.at now with direct Microsoft MVP Authentication as an alternate to the original GitHub with plus bidirectional verification.wheremymvps.atWhere My MVPs At? - MVP Conference Tracker 000
Graham @cirriustech.co.uk · 14/09/2026Good news! Your favourite progressive webapp for GitHub Copilot usage monitoring still works with iOS 27! copelimit.netlify.appcopelimit.netlify.appCopeLimit 000
Graham @cirriustech.co.uk · 14/09/2026How a dedicated Azure API Management Workspace Gateway can still use the managed identity of its parent APIM service. To find out more read my latest blog post - cirriustech.co.uk/blog/apim-wo... #Azure #APIM #ManagedIdentity #WorkspaceGateway #MSRC #Microsoftcirriustech.co.ukDaddy Issues: When APIM Workspaces Inherit the Parent IdentityHow a dedicated Azure API Management Workspace Gateway can still use the managed identity of its parent APIM service. 010
Graham @cirriustech.co.uk · 12/09/2026In a depressed and self loathing kinda mood and can’t find an off switch 131
Graham @cirriustech.co.uk · 07/09/2026This year, a highlight is meeting some online peeps for the first time - after many many years! More please! 020
Graham @cirriustech.co.uk · 03/09/2026Is the @virginiamedia.bsky.social VMO2 backbone screwed? VM 1 Gb fibre currently giving 560kbps and o2 4G giving 2Mbps 010
Graham @cirriustech.co.uk · 31/08/2026So I wrote some poetry to process my grief. I did NOT expect how bleak and angry it would be. And I broke down completely when I reached the end. So I guess that means I needed this 020
Graham @cirriustech.co.uk · 30/08/2026Recreating my YouTube channel - given up on YouTube ever reinstating it or explaining what I did wrong! 3 old videos are back with new thumbnails. My previous disclosure videos I’ll resurrect from my laptop but I’ll also be filming videos for my upcoming disclosures on 14th and 16th September.youtube.comCirriustech 020
