Articles
60 reviews| The claim | Conflation | Filed |
|---|---|---|
| A certified chip is not a genuine chip.A Certified Chip Is Not a Genuine Chip | Control vs property Default is not a control |
2026-09-25 |
| A fast containment time is not a good response.A Fast Containment Time Is Not a Good Response | Control vs property Threat model drift |
2026-09-25 |
| A residual-risk score is not evidence that the control works.A Residual-Risk Score Is Not Evidence a Control Works | Control vs property |
2026-09-25 |
| A strong cipher is not a secure implementation.A Strong Cipher Is Not a Secure Implementation | Control vs property Default is not a control |
2026-09-25 |
| A tool's output is not a validated finding.A Tool's Output Is Not a Validated Finding | Control vs property Default is not a control |
2026-09-25 |
| A validated module is not a protected key.A Validated Module Is Not a Protected Key | Control vs property Compliance vs security |
2026-09-25 |
| An average ransom is not your expected loss.An Average Ransom Is Not an Expected Loss | Control vs property Threat model drift |
2026-09-25 |
| An endpoint verdict is a vendor's label, not an identification.An Endpoint Verdict Is Not a Malware Identification | Control vs property Layer conflation |
2026-09-25 |
| An external trigger is not a continuity defense.An External Trigger Is Not a Continuity Defense | Control vs property Layer conflation |
2026-09-25 |
| Breaking one stage does not stop an intrusion that never needed it.Breaking One Kill-Chain Stage Does Not Stop the Intrusion | Control vs property Threat model drift |
2026-09-25 |
| Three availability zones are not three independent failures.Three Availability Zones Are Not Three Independent Failures | Control vs property Layer conflation |
2026-09-25 |
| Zero findings is not zero flaws.Zero Findings Is Not Zero Flaws | Control vs property Default is not a control |
2026-09-25 |
| Zero trust is only as narrow as your entitlements.Zero Trust Is Only as Narrow as Your Entitlements | Control vs property Identity vs access |
2026-09-25 |
| A CVE is not your exposure.A CVE Is Not Your Exposure | Control vs property Threat model drift |
2026-08-19 |
| A KMS is not key management.A KMS Is Not Key Management | Control vs property Default is not a control |
2026-08-19 |
| A proof of concept is not an exploitable risk assessment.A Proof of Concept Is Not an Exploitable Risk | Control vs property Threat model drift |
2026-08-19 |
| A security tool is not a security control.A Security Tool Is Not a Security Control | Control vs property |
2026-08-19 |
| A TPM is not a key lifecycle.A TPM Is Not a Key Lifecycle | Control vs property |
2026-08-19 |
| A WAF is not an application security programme.A WAF Is Not an Application Security Programme | Control vs property Layer conflation |
2026-08-19 |
| An SBOM is not build provenance.An SBOM Is Not Build Provenance | Control vs property Compliance vs security |
2026-08-19 |
| CWE mapping is not secure code.CWE Mapping Is Not Secure Code | Control vs property Default is not a control |
2026-08-19 |
| Database encryption is not data minimization.Database Encryption Is Not Data Minimization | Control vs property |
2026-08-19 |
| Disaster recovery is not resilience.Disaster Recovery Is Not Resilience | Control vs property Layer conflation |
2026-08-19 |
| Database encryption does not authorize a query.Encrypted Databases Do Not Replace Database Access Control | Control vs property |
2026-08-19 |
| Encryption at rest is not data lifecycle control.Encryption at Rest Is Not Data Lifecycle Control | Control vs property |
2026-08-19 |
| Immutable backups are not ransomware recovery.Immutable Backups Are Not Ransomware Recovery | Control vs property Default is not a control |
2026-08-19 |
| ATT&CK coverage is not detection capability.MITRE ATT&CK Coverage Is Not Detection Capability | Control vs property Threat model drift |
2026-08-19 |
| The claim | Conflation | Filed |
|---|---|---|
| A successful login is not evidence of a legitimate user.A Successful Login Is Not Evidence of a Legitimate User | Identity vs access Threat model drift |
2026-09-25 |
| Watching the gateway is not watching every API.Watching the Gateway Is Not Watching Every API | Identity vs access Default is not a control |
2026-09-25 |
| Zero trust is only as narrow as your entitlements.Zero Trust Is Only as Narrow as Your Entitlements | Control vs property Identity vs access |
2026-09-25 |
| An API gateway is not an authorization system.An API Gateway Is Not an Authorization System | Identity vs access Layer conflation |
2026-08-19 |
| API authentication does not authorize the object.API Authentication Does Not Stop Broken Object Authorization | Identity vs access |
2026-08-19 |
| Authentication is not authorization.Authentication Does Not Authorize Anything | Identity vs access |
2026-08-19 |
| Shared responsibility does not configure your IAM.Cloud Shared Responsibility Does Not Configure IAM | Identity vs access Default is not a control |
2026-08-19 |
| MDM enrollment is not application authorization.MDM Enrollment Is Not Mobile Application Authorization | Identity vs access Layer conflation |
2026-08-19 |
| An ID token is not an API authorization decision.OpenID Connect Login Is Not API Authorization | Identity vs access Default is not a control |
2026-08-19 |
| The claim | Conflation | Filed |
|---|---|---|
| A backup system is not outside the blast radius.A Backup System Is Not Outside the Blast Radius | Layer conflation Default is not a control |
2026-09-25 |
| A flat cloud account is not a blast-radius design.A Flat Cloud Account Is Not a Blast-Radius Design | Layer conflation Default is not a control |
2026-09-25 |
| A managed database is not a secured database.A Managed Database Is Not a Secured Database | Layer conflation Default is not a control |
2026-09-25 |
| A shared top-ten category is not a shared root cause.A Shared Top-Ten List Is Not a Shared Root Cause | Layer conflation |
2026-09-25 |
| A threat-actor name is a vendor's cluster, not a stable adversary.A Threat-Actor Name Is Not a Stable Adversary | Layer conflation Threat model drift |
2026-09-25 |
| An endpoint verdict is a vendor's label, not an identification.An Endpoint Verdict Is Not a Malware Identification | Control vs property Layer conflation |
2026-09-25 |
| An external trigger is not a continuity defense.An External Trigger Is Not a Continuity Defense | Control vs property Layer conflation |
2026-09-25 |
| An IT-only breach is not an IT-only outage.An IT-Only Breach Is Not an IT-Only Outage | Layer conflation Compliance vs security |
2026-09-25 |
| Modeling the application is not modeling the build pipeline.Modeling the Application Is Not Modeling the Build Pipeline | Layer conflation Threat model drift |
2026-09-25 |
| Pre-positioned state access is not ransomware with a different sponsor.Pre-Positioning Is Not Ransomware With a Different Sponsor | Layer conflation Threat model drift |
2026-09-25 |
| Security of processing is not privacy engineering.Security of Processing Is Not Privacy Engineering | Layer conflation Compliance vs security |
2026-09-25 |
| Three availability zones are not three independent failures.Three Availability Zones Are Not Three Independent Failures | Control vs property Layer conflation |
2026-09-25 |
| A component diagram is not a threat model.A Trust Boundary Is Not an Architecture Diagram | Layer conflation Threat model drift |
2026-08-19 |
| A WAF is not an application security programme.A WAF Is Not an Application Security Programme | Control vs property Layer conflation |
2026-08-19 |
| An API gateway is not an authorization system.An API Gateway Is Not an Authorization System | Identity vs access Layer conflation |
2026-08-19 |
| Containment is not evidence preservation.Containment Is Not Evidence Preservation | Layer conflation |
2026-08-19 |
| Disaster recovery is not resilience.Disaster Recovery Is Not Resilience | Control vs property Layer conflation |
2026-08-19 |
| Certification is not a security architecture.ISO Certification Is Not a Security Architecture | Layer conflation Compliance vs security |
2026-08-19 |
| IT segmentation is not OT security.IT Network Segmentation Is Not OT Security | Layer conflation Threat model drift |
2026-08-19 |
| MDM enrollment is not application authorization.MDM Enrollment Is Not Mobile Application Authorization | Identity vs access Layer conflation |
2026-08-19 |
| RTO and RPO are not business continuity.RTO and RPO Are Not Business Continuity | Layer conflation |
2026-08-19 |
| Zero trust does not abolish network segmentation.Zero Trust Does Not Abolish Network Segmentation | Layer conflation |
2026-08-19 |
| Zero trust is an access architecture, not a product category.Zero Trust Is Not a Product Category | Layer conflation Default is not a control |
2026-08-19 |
| The claim | Conflation | Filed |
|---|---|---|
| A backup system is not outside the blast radius.A Backup System Is Not Outside the Blast Radius | Layer conflation Default is not a control |
2026-09-25 |
| A certified chip is not a genuine chip.A Certified Chip Is Not a Genuine Chip | Control vs property Default is not a control |
2026-09-25 |
| A clean CVE scan is not a healthy dependency tree.A Clean CVE Scan Is Not a Healthy Dependency Tree | Default is not a control Threat model drift |
2026-09-25 |
| A CVE ID is not a confirmed vulnerability.A CVE ID Is Not a Confirmed Vulnerability | Default is not a control Threat model drift |
2026-09-25 |
| A flat cloud account is not a blast-radius design.A Flat Cloud Account Is Not a Blast-Radius Design | Layer conflation Default is not a control |
2026-09-25 |
| A managed database is not a secured database.A Managed Database Is Not a Secured Database | Layer conflation Default is not a control |
2026-09-25 |
| A strong cipher is not a secure implementation.A Strong Cipher Is Not a Secure Implementation | Control vs property Default is not a control |
2026-09-25 |
| A tool's output is not a validated finding.A Tool's Output Is Not a Validated Finding | Control vs property Default is not a control |
2026-09-25 |
| Fully patched is not out of reach of a surveillance vendor.Fully Patched Is Not Out of Reach of a Surveillance Vendor | Default is not a control Threat model drift |
2026-09-25 |
| Watching the gateway is not watching every API.Watching the Gateway Is Not Watching Every API | Identity vs access Default is not a control |
2026-09-25 |
| Zero findings is not zero flaws.Zero Findings Is Not Zero Flaws | Control vs property Default is not a control |
2026-09-25 |
| A KMS is not key management.A KMS Is Not Key Management | Control vs property Default is not a control |
2026-08-19 |
| Shared responsibility does not configure your IAM.Cloud Shared Responsibility Does Not Configure IAM | Identity vs access Default is not a control |
2026-08-19 |
| CWE mapping is not secure code.CWE Mapping Is Not Secure Code | Control vs property Default is not a control |
2026-08-19 |
| Immutable backups are not ransomware recovery.Immutable Backups Are Not Ransomware Recovery | Control vs property Default is not a control |
2026-08-19 |
| An ID token is not an API authorization decision.OpenID Connect Login Is Not API Authorization | Identity vs access Default is not a control |
2026-08-19 |
| Zero trust is an access architecture, not a product category.Zero Trust Is Not a Product Category | Layer conflation Default is not a control |
2026-08-19 |
| The claim | Conflation | Filed |
|---|---|---|
| A validated module is not a protected key.A Validated Module Is Not a Protected Key | Control vs property Compliance vs security |
2026-09-25 |
| An IT-only breach is not an IT-only outage.An IT-Only Breach Is Not an IT-Only Outage | Layer conflation Compliance vs security |
2026-09-25 |
| Security of processing is not privacy engineering.Security of Processing Is Not Privacy Engineering | Layer conflation Compliance vs security |
2026-09-25 |
| An SBOM is not build provenance.An SBOM Is Not Build Provenance | Control vs property Compliance vs security |
2026-08-19 |
| Certification is not a security architecture.ISO Certification Is Not a Security Architecture | Layer conflation Compliance vs security |
2026-08-19 |
| Passing an audit is not proof of control effectiveness.Passing an Audit Is Not Control Effectiveness | Compliance vs security |
2026-08-19 |
| The claim | Conflation | Filed |
|---|---|---|
| A clean CVE scan is not a healthy dependency tree.A Clean CVE Scan Is Not a Healthy Dependency Tree | Default is not a control Threat model drift |
2026-09-25 |
| A commodity loader is not a nuisance infection.A Commodity Loader Is Not a Nuisance Infection | Threat model drift | 2026-09-25 |
| A CVE ID is not a confirmed vulnerability.A CVE ID Is Not a Confirmed Vulnerability | Default is not a control Threat model drift |
2026-09-25 |
| A fast containment time is not a good response.A Fast Containment Time Is Not a Good Response | Control vs property Threat model drift |
2026-09-25 |
| A sophisticated attacker is not an explanation.A Sophisticated Attacker Is Not an Explanation | Threat model drift | 2026-09-25 |
| A successful login is not evidence of a legitimate user.A Successful Login Is Not Evidence of a Legitimate User | Identity vs access Threat model drift |
2026-09-25 |
| A threat-actor name is a vendor's cluster, not a stable adversary.A Threat-Actor Name Is Not a Stable Adversary | Layer conflation Threat model drift |
2026-09-25 |
| An average ransom is not your expected loss.An Average Ransom Is Not an Expected Loss | Control vs property Threat model drift |
2026-09-25 |
| APT-grade capability is not reserved for APTs.APT-Grade Capability Is Not Reserved for APTs | Threat model drift | 2026-09-25 |
| Breaking one stage does not stop an intrusion that never needed it.Breaking One Kill-Chain Stage Does Not Stop the Intrusion | Control vs property Threat model drift |
2026-09-25 |
| Fully patched is not out of reach of a surveillance vendor.Fully Patched Is Not Out of Reach of a Surveillance Vendor | Default is not a control Threat model drift |
2026-09-25 |
| Modeling the application is not modeling the build pipeline.Modeling the Application Is Not Modeling the Build Pipeline | Layer conflation Threat model drift |
2026-09-25 |
| Pre-positioned state access is not ransomware with a different sponsor.Pre-Positioning Is Not Ransomware With a Different Sponsor | Layer conflation Threat model drift |
2026-09-25 |
| A CVE is not your exposure.A CVE Is Not Your Exposure | Control vs property Threat model drift |
2026-08-19 |
| A proof of concept is not an exploitable risk assessment.A Proof of Concept Is Not an Exploitable Risk | Control vs property Threat model drift |
2026-08-19 |
| A risk register is not a threat model.A Risk Register Is Not a Threat Model | Threat model drift | 2026-08-19 |
| A component diagram is not a threat model.A Trust Boundary Is Not an Architecture Diagram | Layer conflation Threat model drift |
2026-08-19 |
| A breach lesson is not your threat model.Breach Lessons Are Not a Threat Model | Threat model drift | 2026-08-19 |
| IT segmentation is not OT security.IT Network Segmentation Is Not OT Security | Layer conflation Threat model drift |
2026-08-19 |
| ATT&CK coverage is not detection capability.MITRE ATT&CK Coverage Is Not Detection Capability | Control vs property Threat model drift |
2026-08-19 |
Review worksheet
Name the property, then the control.
One worksheet for taking an architecture claim apart: the property being asserted, the mechanism actually in place, the gap between them, and what the gap costs. Sent once.
One email. No list, no sequence.