When autonomous agents manage cloud operations via Amazon Bedrock, relying on generative LLMs for safety checks introduces intolerable latency, token drain, and prompt-injection risks. Here is how I built Aegis-2B, a sub-second fail-closed safety circuit breaker and 3-tier router running inside Botocore.
A structured daily study plan to fill the remaining gaps in cloud security and DevSecOps - covering IAM, AWS security services, secrets management, container hardening, pipeline security, and incident response.
Welcome to Module 3: Network and Perimeter Defense of TryHackMe’s Defending AWS learning path. In Module 2, we mastered the cloud identity plane: pruning over-privileged users, containing compromis...
Overview Shared Responsibility Model is Room 1.2 in Module 1 (Welcome to AWS) of TryHackMe’s Defending AWS learning path. One of the most prevalent misconceptions in cloud migration is the belief ...
Capstone defensive audit and remediation walkthrough of the Lockdown room on TryHackMe, diagnosing and repairing three critical vulnerabilities in Bastion AI across metadata pre-filtering, log sanitization, and tenant isolation to reconstruct the complete flag.
Capstone walkthrough of the UnIndexed CTF challenge on TryHackMe, auditing Cloudwright Labs' internal assistant Atlas to exploit unsegmented vector retrieval, uncover Project Lantern, and extract boardroom secrets.
Comprehensive audit and sandbox evaluation of four AI code-review model candidates in TryHackMe's Checkpoint room. Evaluates pickle deserialization file access, disabled security guardrails, CommunityReview prompt tampering, Keras Lambda backdoors, and SafeTensors approval.
Technical analysis of OWASP LLM02 Sensitive Information Disclosure across RAG architectures, examining vector proximity leakage, semantic collisions, multi-tenant segmentation failures, and deterministic pre-query access controls.
Practical forensic incident response of TryTrainMe's compromised production code review model in the TryHackMe Payload challenge room. Dissects unauthenticated outbound beaconing, pickle bytecode decompilation with Fickling, host reconnaissance commands, and Keras Lambda persistence in candidate models.
Technical analysis of data poisoning across AI lifecycles, contrasting training data poisoning with embedding and corpus poisoning, exploring automated ingestion pipeline attacks, and modeling behavioral drift detection.