https://loadpathresearch.com Cybersecurity — architecture, controls, threat modelling, and the arguments practitioners actually have with each other. en-US https://loadpathresearch.com/blog/cyber-insurance/ https://loadpathresearch.com/blog/cyber-insurance/ Sat, 26 Sep 2026 00:00:00 +0000 Underwriting questionnaires demand MFA, endpoint detection, and tested backups. Policies exclude some attacks, require insurer-approved response firms, and can be contested if the application overstated your controls. The insurer has become a security stakeholder with its own interests. https://loadpathresearch.com/articles/a-backup-system-is-not-outside-the-blast-radius/ https://loadpathresearch.com/articles/a-backup-system-is-not-outside-the-blast-radius/ Fri, 25 Sep 2026 00:00:00 +0000 Ransomware operators now try to compromise the backups in almost every attack, and backup software holds the credentials for everything it protects. A fallback that shares production's credentials or control plane falls with production. https://loadpathresearch.com/articles/a-certified-chip-is-not-a-genuine-chip/ https://loadpathresearch.com/articles/a-certified-chip-is-not-a-genuine-chip/ Fri, 25 Sep 2026 00:00:00 +0000 A certificate evaluates a design and a signature names who published something; neither proves that this unit or this build is the genuine, unmodified instance. Roots of trust sit at the very start of a supply chain that checks identity, not artifacts. https://loadpathresearch.com/articles/a-clean-cve-scan-is-not-a-healthy-dependency-tree/ https://loadpathresearch.com/articles/a-clean-cve-scan-is-not-a-healthy-dependency-tree/ Fri, 25 Sep 2026 00:00:00 +0000 A dependency scanner sees flaws that have been disclosed, identified and enriched. Maintainer takeovers and malicious sub-dependencies get an identifier only after someone finds them, and an abandoned component gets none at all. https://loadpathresearch.com/articles/a-commodity-loader-is-not-a-nuisance-infection/ https://loadpathresearch.com/articles/a-commodity-loader-is-not-a-nuisance-infection/ Fri, 25 Sep 2026 00:00:00 +0000 A loader's job is to establish a foothold and fetch the next stage, and the families that do it have been rented out as ransomware's initial access. Closing the ticket on the file does not answer who the foothold was handed to. https://loadpathresearch.com/articles/a-cve-id-is-not-a-confirmed-vulnerability/ https://loadpathresearch.com/articles/a-cve-id-is-not-a-confirmed-vulnerability/ Fri, 25 Sep 2026 00:00:00 +0000 A CVE records that someone asked for an identifier and a numbering authority issued one. Whether the flaw is real is a separate question, and the status meant to answer it usually never resolves. https://loadpathresearch.com/articles/a-fast-containment-time-is-not-a-good-response/ https://loadpathresearch.com/articles/a-fast-containment-time-is-not-a-good-response/ Fri, 25 Sep 2026 00:00:00 +0000 Detection and containment clocks start and stop on events each organization defines for itself, and can improve without the response improving. A new tool or managed service changes where alerts come from, not what counts as contained. https://loadpathresearch.com/articles/a-flat-cloud-account-is-not-a-blast-radius-design/ https://loadpathresearch.com/articles/a-flat-cloud-account-is-not-a-blast-radius-design/ Fri, 25 Sep 2026 00:00:00 +0000 Cloud platforms already enforce a default-deny boundary between accounts, subscriptions and projects. Putting every workload in one account trades that boundary for configuration inside it, and posture tools can report the drift but not stop it. https://loadpathresearch.com/articles/a-managed-database-is-not-a-secured-database/ https://loadpathresearch.com/articles/a-managed-database-is-not-a-secured-database/ Fri, 25 Sep 2026 00:00:00 +0000 A managed database service takes the host, the operating system and engine patching off the customer's hands, and not the rest. Reachability, encryption settings, access policy and who owns the exported snapshot stay with the customer, and that is where the documented exposures happened. https://loadpathresearch.com/articles/a-residual-risk-score-is-not-evidence-a-control-works/ https://loadpathresearch.com/articles/a-residual-risk-score-is-not-evidence-a-control-works/ Fri, 25 Sep 2026 00:00:00 +0000 A residual-risk score can drop as soon as a mitigation is recorded, whatever evidence stands behind the record. A Moderate that rests on an untested control and a hopeful likelihood routes exactly like one that rests on a test. https://loadpathresearch.com/articles/a-shared-top-ten-list-is-not-a-shared-root-cause/ https://loadpathresearch.com/articles/a-shared-top-ten-list-is-not-a-shared-root-cause/ Fri, 25 Sep 2026 00:00:00 +0000 Injection, deserialization and SSRF share one mechanism; broken access control does not share it, even though it sits beside injection on the OWASP Top 10. Grouping findings by list or bucket reads like root-cause analysis without being it. https://loadpathresearch.com/articles/a-sophisticated-attacker-is-not-an-explanation/ https://loadpathresearch.com/articles/a-sophisticated-attacker-is-not-an-explanation/ Fri, 25 Sep 2026 00:00:00 +0000 Sophistication folds stealth, patience and target choice into one adjective and drops the confidence behind the attribution. Each of those axes changes what the victim must now assume, and the adjective answers none of them. https://loadpathresearch.com/articles/a-strong-cipher-is-not-a-secure-implementation/ https://loadpathresearch.com/articles/a-strong-cipher-is-not-a-secure-implementation/ Fri, 25 Sep 2026 00:00:00 +0000 The recorded cryptographic failures left the primitive untouched: the mode leaked structure, a validation check was skipped, a weak option stayed negotiable, an error message told the attacker too much. Naming the cipher says almost nothing about any of them. https://loadpathresearch.com/articles/a-successful-login-is-not-evidence-of-a-legitimate-user/ https://loadpathresearch.com/articles/a-successful-login-is-not-evidence-of-a-legitimate-user/ Fri, 25 Sep 2026 00:00:00 +0000 A stolen credential gets an attacker in, keeps them in, carries its privileges and makes their logons look ordinary. The authentication event is where they look most legitimate, so detection has to judge what the account does next. https://loadpathresearch.com/articles/a-threat-actor-name-is-not-a-stable-adversary/ https://loadpathresearch.com/articles/a-threat-actor-name-is-not-a-stable-adversary/ Fri, 25 Sep 2026 00:00:00 +0000 An actor name is one vendor's cluster of what it could see, and it can merge, be forged against, or retire while the people behind it keep working. Defensive decisions keyed to the label inherit every one of those moves. https://loadpathresearch.com/articles/a-tools-output-is-not-a-validated-finding/ https://loadpathresearch.com/articles/a-tools-output-is-not-a-validated-finding/ Fri, 25 Sep 2026 00:00:00 +0000 Every verdict a security tool emits comes from a method with its own failure mode, and forensics learned the hard way to test tools by version and reproduce results with a second one. A finding that will cost someone something needs the same treatment. https://loadpathresearch.com/articles/a-validated-module-is-not-a-protected-key/ https://loadpathresearch.com/articles/a-validated-module-is-not-a-protected-key/ Fri, 25 Sep 2026 00:00:00 +0000 Validation programmes test an algorithm, a module or a live endpoint at a fixed point, and standards produce four different kinds of evidence. The documented key failures happened at generation, rotation and disclosure, stages none of those checks watches. https://loadpathresearch.com/articles/an-average-ransom-is-not-an-expected-loss/ https://loadpathresearch.com/articles/an-average-ransom-is-not-an-expected-loss/ Fri, 25 Sep 2026 00:00:00 +0000 Ransom and breach-cost averages are dragged by a handful of enormous cases, and a payment often buys neither full recovery nor deletion. A pay, insure or mitigate decision sized on an average is priced against the wrong distribution. https://loadpathresearch.com/articles/an-endpoint-verdict-is-not-a-malware-identification/ https://loadpathresearch.com/articles/an-endpoint-verdict-is-not-a-malware-identification/ Fri, 25 Sep 2026 00:00:00 +0000 A detection name is one vendor's label for a file, and vendors often disagree on it. What the sample does on your host, and whether the same agent could see it on your other platforms, are separate questions. https://loadpathresearch.com/articles/an-external-trigger-is-not-a-continuity-defense/ https://loadpathresearch.com/articles/an-external-trigger-is-not-a-continuity-defense/ Fri, 25 Sep 2026 00:00:00 +0000 A vendor's bad update or a winter storm starts the outage; a US regulator has still charged the affected company for how long its recovery took, and a vendor's liability cap left another fighting in court for its losses. Handling the incident correctly does not settle who answers for the business staying down. https://loadpathresearch.com/articles/an-it-only-breach-is-not-an-it-only-outage/ https://loadpathresearch.com/articles/an-it-only-breach-is-not-an-it-only-outage/ Fri, 25 Sep 2026 00:00:00 +0000 Colonial Pipeline's ransomware never touched the systems that move fuel; the company shut the pipeline itself because it could not show they were clean. Whether an IT incident stops operations depends on what the operator can prove about OT, not on where the attacker went. https://loadpathresearch.com/articles/apt-grade-capability-is-not-reserved-for-apts/ https://loadpathresearch.com/articles/apt-grade-capability-is-not-reserved-for-apts/ Fri, 25 Sep 2026 00:00:00 +0000 Capability belongs to the tool, not to whoever is running it, and state-grade and red-team tooling has repeatedly leaked into commodity use. A threat model that scopes adversaries by who they are keeps an assumption 2017 already broke. https://loadpathresearch.com/articles/breaking-one-kill-chain-stage-does-not-stop-the-intrusion/ https://loadpathresearch.com/articles/breaking-one-kill-chain-stage-does-not-stop-the-intrusion/ Fri, 25 Sep 2026 00:00:00 +0000 The kill chain assumes every intrusion passes through every stage in order, so one broken link defeats it. An adversary who starts with valid accounts never needed the stage you guarded, and a stage list is not a map of your own system. https://loadpathresearch.com/articles/fully-patched-is-not-out-of-reach-of-a-surveillance-vendor/ https://loadpathresearch.com/articles/fully-patched-is-not-out-of-reach-of-a-surveillance-vendor/ Fri, 25 Sep 2026 00:00:00 +0000 Commercial surveillance vendors keep exploit development as a standing product and aim it at fully patched phones. Patch status answers whether a known chain still works, not whether the chain in use against a chosen person does. https://loadpathresearch.com/articles/modeling-the-application-is-not-modeling-the-build-pipeline/ https://loadpathresearch.com/articles/modeling-the-application-is-not-modeling-the-build-pipeline/ Fri, 25 Sep 2026 00:00:00 +0000 A threat model covers what was drawn and fails silently at its scope edge. Dependency confusion and a poisoned CI script compromised builds, and a committed secret opened a company's cloud data, without the application itself being attacked. https://loadpathresearch.com/articles/pre-positioning-is-not-ransomware-with-a-different-sponsor/ https://loadpathresearch.com/articles/pre-positioning-is-not-ransomware-with-a-different-sponsor/ Fri, 25 Sep 2026 00:00:00 +0000 A ransomware crew wants payment and stops when paid; a state actor pre-positioned in a utility wants the access itself and has no such exit. A sector plan built only for the first assumes an off-ramp the second does not offer. https://loadpathresearch.com/articles/security-of-processing-is-not-privacy-engineering/ https://loadpathresearch.com/articles/security-of-processing-is-not-privacy-engineering/ Fri, 25 Sep 2026 00:00:00 +0000 Security frameworks ask whether personal data is protected; the documented privacy failures happened in systems whose security worked exactly as designed. A clean security assessment says nothing about whether the processing should happen, for whom consent holds, or what the data is now used for. https://loadpathresearch.com/articles/three-availability-zones-are-not-three-independent-failures/ https://loadpathresearch.com/articles/three-availability-zones-are-not-three-independent-failures/ Fri, 25 Sep 2026 00:00:00 +0000 Zone redundancy protects against losing a facility; it does not protect against the regional subsystems and control plane every zone calls through. The documented cloud outages hit exactly that shared layer. https://loadpathresearch.com/articles/watching-the-gateway-is-not-watching-every-api/ https://loadpathresearch.com/articles/watching-the-gateway-is-not-watching-every-api/ Fri, 25 Sep 2026 00:00:00 +0000 Each API detection layer has its own blind spot, and authorization failures look like ordinary authenticated traffic. The documented API exposures were found by outsiders or ran for weeks before anyone noticed. https://loadpathresearch.com/articles/zero-findings-is-not-zero-flaws/ https://loadpathresearch.com/articles/zero-findings-is-not-zero-flaws/ Fri, 25 Sep 2026 00:00:00 +0000 A scan that never reached part of an application reports exactly what a scan that tested it clean reports. Design flaws, wrong-but-present authorization checks and unexercised paths all pass as silence. https://loadpathresearch.com/articles/zero-trust-is-only-as-narrow-as-your-entitlements/ https://loadpathresearch.com/articles/zero-trust-is-only-as-narrow-as-your-entitlements/ Fri, 25 Sep 2026 00:00:00 +0000 An identity-centric policy engine weighs the identity and its assigned attributes above everything else. Evaluated on every request, an over-broad grant is still an over-broad grant, and the reach of a stolen credential is set by the entitlement inventory. https://loadpathresearch.com/blog/deletion-as-security/ https://loadpathresearch.com/blog/deletion-as-security/ Fri, 25 Sep 2026 00:00:00 +0000 Over-retention expands every breach: more records to notify about, more regulators involved, more liability. Retention schedules are usually written for legal holds and forgotten by IT. Treating deletion as a security control and finding the copies in backups, exports, and test environments. https://loadpathresearch.com/blog/passkeys-and-recovery/ https://loadpathresearch.com/blog/passkeys-and-recovery/ Fri, 25 Sep 2026 00:00:00 +0000 Passkeys resist phishing and make password databases useless to attackers. The hard part of a rollout isn't the cryptography; it's lost devices, shared accounts, legacy apps and recovery. https://loadpathresearch.com/blog/phishing-resistant-mfa/ https://loadpathresearch.com/blog/phishing-resistant-mfa/ Sat, 12 Sep 2026 00:00:00 +0000 Enrollment metrics hide the real work of phishing-resistant authentication: closing password paths, managing exceptions, and deciding what to do with systems that will never support it. https://loadpathresearch.com/blog/service-accounts/ https://loadpathresearch.com/blog/service-accounts/ Fri, 11 Sep 2026 00:00:00 +0000 The quarterly access review for non-human identities follows a predictable script, and the actual security posture of the estate has not moved an inch. https://loadpathresearch.com/blog/dmz-appliances/ https://loadpathresearch.com/blog/dmz-appliances/ Fri, 04 Sep 2026 00:00:00 +0000 A decision framework for internet-facing appliances: when to retire, replace, segment, or patch them, and which structural conditions change the answer. https://loadpathresearch.com/blog/padlock-is-not-trust/ https://loadpathresearch.com/blog/padlock-is-not-trust/ Tue, 01 Sep 2026 00:00:00 +0000 A padlock only means the connection is encrypted; phishing pages have valid certificates too. Teach people to read the domain, not the lock. https://loadpathresearch.com/blog/sso-tax/ https://loadpathresearch.com/blog/sso-tax/ Sun, 30 Aug 2026 00:00:00 +0000 Vendors put SAML single sign-on, SCIM provisioning, and detailed audit logs behind enterprise tiers. The logs you need during an investigation are often the ones you chose not to pay for. https://loadpathresearch.com/blog/certificate-expiry/ https://loadpathresearch.com/blog/certificate-expiry/ Fri, 28 Aug 2026 00:00:00 +0000 Shorter certificate lifetimes, broken ownership records, and manual renewal processes make expired certificates a predictable operational failure. https://loadpathresearch.com/articles/a-cve-is-not-your-exposure/ https://loadpathresearch.com/articles/a-cve-is-not-your-exposure/ Wed, 19 Aug 2026 00:00:00 +0000 A CVE identifies a disclosed flaw; it does not say whether the vulnerable code is present, reachable, privileged, internet-facing, or already mitigated in your environment. Exposure is the system-specific path from flaw to consequence. https://loadpathresearch.com/articles/a-kms-is-not-key-management/ https://loadpathresearch.com/articles/a-kms-is-not-key-management/ Wed, 19 Aug 2026 00:00:00 +0000 A key-management service can store and use keys without answering who may request them, how trust changes, or how an emergency revocation actually takes effect. The hard work is the lifecycle around the service. https://loadpathresearch.com/articles/a-proof-of-concept-is-not-an-exploitable-risk/ https://loadpathresearch.com/articles/a-proof-of-concept-is-not-an-exploitable-risk/ Wed, 19 Aug 2026 00:00:00 +0000 A proof of concept can establish that a flaw exists under stated conditions; it does not establish reliability, usable access, impact, or relevance to a particular deployment. Defenders need the path from weakness to consequence, not a binary label. https://loadpathresearch.com/articles/a-risk-register-is-not-a-threat-model/ https://loadpathresearch.com/articles/a-risk-register-is-not-a-threat-model/ Wed, 19 Aug 2026 00:00:00 +0000 A risk register records decisions about exposure; a threat model discovers how a system can be abused. Replacing the latter with likelihood-and-impact labels leaves the architecture with no attack paths to design against. https://loadpathresearch.com/articles/a-security-tool-is-not-a-security-control/ https://loadpathresearch.com/articles/a-security-tool-is-not-a-security-control/ Wed, 19 Aug 2026 00:00:00 +0000 A scanner, EDR, gateway, or SIEM becomes a control only when its configuration, owner, signal, response, and evidence produce the intended prevention, detection, or correction. Installed software is not a security outcome. https://loadpathresearch.com/articles/a-tpm-is-not-a-key-lifecycle/ https://loadpathresearch.com/articles/a-tpm-is-not-a-key-lifecycle/ Wed, 19 Aug 2026 00:00:00 +0000 A TPM can bind or protect key material to a device state; it does not choose when credentials rotate, how certificates are revoked, or who recovers a service after hardware loss. Hardware root of trust is a component of key management, not its replacement. https://loadpathresearch.com/articles/a-trust-boundary-is-not-an-architecture-diagram/ https://loadpathresearch.com/articles/a-trust-boundary-is-not-an-architecture-diagram/ Wed, 19 Aug 2026 00:00:00 +0000 A diagram of components is not yet a security architecture if it does not show who can cross which boundary, under what identity, and what happens when a component is compromised. Threat modeling gives the arrows consequences. https://loadpathresearch.com/articles/a-waf-is-not-an-application-security-programme/ https://loadpathresearch.com/articles/a-waf-is-not-an-application-security-programme/ Wed, 19 Aug 2026 00:00:00 +0000 A WAF can block some malicious requests at the edge; it cannot repair authorization logic, unsafe deserialization, or an SSRF-capable application. The article draws the boundary between network filtering and application behavior. https://loadpathresearch.com/articles/an-api-gateway-is-not-an-authorization-system/ https://loadpathresearch.com/articles/an-api-gateway-is-not-an-authorization-system/ Wed, 19 Aug 2026 00:00:00 +0000 A gateway can authenticate, rate-limit, validate, and route requests, but it cannot infer the business rule that makes one object visible and another forbidden. Identity plumbing is not entitlement design. https://loadpathresearch.com/articles/an-sbom-is-not-build-provenance/ https://loadpathresearch.com/articles/an-sbom-is-not-build-provenance/ Wed, 19 Aug 2026 00:00:00 +0000 An SBOM says what components are reported in an artifact; it does not show that the build process was protected from tampering. The SolarWinds mechanism makes the missing link painfully concrete. https://loadpathresearch.com/articles/api-authentication-does-not-stop-bola/ https://loadpathresearch.com/articles/api-authentication-does-not-stop-bola/ Wed, 19 Aug 2026 00:00:00 +0000 A valid API token identifies the caller; it does not prove that the caller owns the invoice, profile, or tenant record named in the request. Object-level authorization must run against each requested object. https://loadpathresearch.com/articles/authentication-does-not-authorize-anything/ https://loadpathresearch.com/articles/authentication-does-not-authorize-anything/ Wed, 19 Aug 2026 00:00:00 +0000 A verified user is an input to an access decision, not the decision itself. This separates proof of a claimant from entitlement, scope, and privileged-action approval. https://loadpathresearch.com/articles/breach-lessons-are-not-a-threat-model/ https://loadpathresearch.com/articles/breach-lessons-are-not-a-threat-model/ Wed, 19 Aug 2026 00:00:00 +0000 A famous breach can expose a failed assumption and supply a useful control lesson; copying its headline control into a different system is not threat modeling. History is evidence for questions, not a substitute for asking them locally. https://loadpathresearch.com/articles/cloud-shared-responsibility-does-not-configure-iam/ https://loadpathresearch.com/articles/cloud-shared-responsibility-does-not-configure-iam/ Wed, 19 Aug 2026 00:00:00 +0000 The provider can secure the cloud while your tenant still grants a workload, user, or storage policy far more access than intended. Shared responsibility is an allocation of work, not a completed control. https://loadpathresearch.com/articles/containment-is-not-evidence-preservation/ https://loadpathresearch.com/articles/containment-is-not-evidence-preservation/ Wed, 19 Aug 2026 00:00:00 +0000 Containment stops an active path; forensic preservation keeps the facts needed to explain it. Reimaging, rebooting, or deleting an account can be the right containment action and still destroy the evidence required for a defensible investigation. https://loadpathresearch.com/articles/cwe-mapping-is-not-secure-code/ https://loadpathresearch.com/articles/cwe-mapping-is-not-secure-code/ Wed, 19 Aug 2026 00:00:00 +0000 Classifying a finding as a weakness can make recurring patterns visible; it does not remove the unsafe data flow, authorization assumption, or memory operation in the product. Taxonomy is a diagnostic aid, not a remediation. https://loadpathresearch.com/articles/database-encryption-is-not-data-minimization/ https://loadpathresearch.com/articles/database-encryption-is-not-data-minimization/ Wed, 19 Aug 2026 00:00:00 +0000 A well-encrypted database still contains every unnecessary identifier, history record, and replica you decided to retain. Privacy engineering changes the data estate; database controls protect the estate that remains. https://loadpathresearch.com/articles/disaster-recovery-is-not-resilience/ https://loadpathresearch.com/articles/disaster-recovery-is-not-resilience/ Wed, 19 Aug 2026 00:00:00 +0000 Recovery restores a service after a declared loss; resilience keeps useful service available or degrades safely while failure is underway. A restore plan does not by itself limit blast radius or preserve an operation. https://loadpathresearch.com/articles/encrypted-databases-do-not-replace-database-access-control/ https://loadpathresearch.com/articles/encrypted-databases-do-not-replace-database-access-control/ Wed, 19 Aug 2026 00:00:00 +0000 Encryption at rest protects a storage exposure; it does not stop an authorized application, compromised workload identity, or overbroad database role from reading every row. The access model remains the security boundary that operates day to day. https://loadpathresearch.com/articles/encryption-at-rest-is-not-data-lifecycle-control/ https://loadpathresearch.com/articles/encryption-at-rest-is-not-data-lifecycle-control/ Wed, 19 Aug 2026 00:00:00 +0000 Encrypted storage narrows one exposure path, but it does not decide whether the data should exist, who can decrypt it, or whether deletion can be demonstrated. The property people need is governed retention and key separation. https://loadpathresearch.com/articles/immutable-backups-are-not-ransomware-recovery/ https://loadpathresearch.com/articles/immutable-backups-are-not-ransomware-recovery/ Wed, 19 Aug 2026 00:00:00 +0000 Immutability can stop an attacker from altering a backup set; it does not prove the data is complete, the restore is clean, the identity plane is usable, or the business can restart. Recovery is an exercised system, not a storage adjective. https://loadpathresearch.com/articles/iso-certification-is-not-a-security-architecture/ https://loadpathresearch.com/articles/iso-certification-is-not-a-security-architecture/ Wed, 19 Aug 2026 00:00:00 +0000 A management-system certificate can show that governance processes exist; it cannot choose trust boundaries, enforce an authorization check, or establish a recovery objective. Standards organize work, while architecture makes security properties real. https://loadpathresearch.com/articles/it-network-segmentation-is-not-ot-security/ https://loadpathresearch.com/articles/it-network-segmentation-is-not-ot-security/ Wed, 19 Aug 2026 00:00:00 +0000 Putting industrial systems in a separate VLAN can reduce reachability, but it does not add authentication to fieldbus protocols, preserve safety availability, or establish a safe maintenance path. OT has physical-process consequences that ordinary IT zoning does not solve. https://loadpathresearch.com/articles/mdm-enrollment-is-not-mobile-application-authorization/ https://loadpathresearch.com/articles/mdm-enrollment-is-not-mobile-application-authorization/ Wed, 19 Aug 2026 00:00:00 +0000 A managed phone can satisfy device policy while the person, app session, and backend request still need their own authorization decisions. Device management and identity access travel together but protect different objects. https://loadpathresearch.com/articles/mitre-coverage-is-not-detection-capability/ https://loadpathresearch.com/articles/mitre-coverage-is-not-detection-capability/ Wed, 19 Aug 2026 00:00:00 +0000 Mapping a tool or rule to an ATT&CK technique can show an intended area of visibility; it does not show that telemetry is present, the analytic works, or responders can use it. Coverage is a catalogue claim, not an outcome. https://loadpathresearch.com/articles/openid-connect-login-is-not-api-authorization/ https://loadpathresearch.com/articles/openid-connect-login-is-not-api-authorization/ Wed, 19 Aug 2026 00:00:00 +0000 An ID token can tell a client who signed in; it is not a permission slip for every API it can reach. The piece draws the hard line between protocol assertion, audience, scope, and service-side authorization. https://loadpathresearch.com/articles/passing-an-audit-is-not-control-effectiveness/ https://loadpathresearch.com/articles/passing-an-audit-is-not-control-effectiveness/ Wed, 19 Aug 2026 00:00:00 +0000 An audit can establish that a control exists and was evidenced for a period; it does not establish that the control will stop the failure mode now under review. The article makes evidence, operating effectiveness, and security outcome separate claims. https://loadpathresearch.com/articles/rto-and-rpo-are-not-business-continuity/ https://loadpathresearch.com/articles/rto-and-rpo-are-not-business-continuity/ Wed, 19 Aug 2026 00:00:00 +0000 Recovery objectives tell technology how quickly to restore a service and how much data loss is tolerated; they do not tell the organization how to continue the critical process while it is unavailable. The missing design is the manual and operational workaround. https://loadpathresearch.com/articles/zero-trust-does-not-abolish-network-segmentation/ https://loadpathresearch.com/articles/zero-trust-does-not-abolish-network-segmentation/ Wed, 19 Aug 2026 00:00:00 +0000 Identity-centric access can make a compromised network location less trustworthy; it does not make unrestricted east-west reachability harmless. Segmentation still limits paths, services, and blast radius. https://loadpathresearch.com/articles/zero-trust-is-not-a-product-category/ https://loadpathresearch.com/articles/zero-trust-is-not-a-product-category/ Wed, 19 Aug 2026 00:00:00 +0000 Buying a zero-trust product does not establish zero trust when access is still granted once and carried forward. The architecture is continuous, resource-level evaluation under an assumed-compromise premise. https://loadpathresearch.com/blog/end-of-life-systems/ https://loadpathresearch.com/blog/end-of-life-systems/ Sun, 02 Aug 2026 00:00:00 +0000 What actually happens when a critical system cannot be patched or replaced, and how the risk acceptance becomes the real deliverable. https://loadpathresearch.com/blog/restoring-active-directory/ https://loadpathresearch.com/blog/restoring-active-directory/ Tue, 28 Jul 2026 00:00:00 +0000 Most disaster recovery plans assume identity is available. A full forest recovery is rarely rehearsed, and the runbook is often stored somewhere that requires the directory to open. https://loadpathresearch.com/blog/ir-plan-without-email/ https://loadpathresearch.com/blog/ir-plan-without-email/ Thu, 23 Jul 2026 00:00:00 +0000 The plan lives on a file share that is encrypted, the contact list is in the directory that is down, and the attacker may be reading the Teams channel where responders coordinate. Out-of-band communication, printed contacts, and rehearsing the response without the tools you normally use. https://loadpathresearch.com/blog/mfa-is-not-optional/ https://loadpathresearch.com/blog/mfa-is-not-optional/ Tue, 21 Jul 2026 00:00:00 +0000 A stolen password shouldn't be a master key. MFA is the baseline, but coverage, method and recovery decide whether it works: SMS and push prompts leave gaps that security keys and passkeys close. https://loadpathresearch.com/blog/wipe-the-printer/ https://loadpathresearch.com/blog/wipe-the-printer/ Tue, 14 Jul 2026 00:00:00 +0000 Multifunction printers, network switches, and conference room systems store credentials and documents. Decommissioning procedures that cover laptops and servers usually skip the devices nobody thinks of as computers. https://loadpathresearch.com/blog/backups-ransomware-target/ https://loadpathresearch.com/blog/backups-ransomware-target/ Thu, 09 Jul 2026 00:00:00 +0000 Ransomware operators take the backup plane before they encrypt production. The controls that matter are compliance-mode immutability, separate-account cloud permissions, offline copies, and restore tests that measure full recovery time. https://loadpathresearch.com/blog/pen-test-reports/ https://loadpathresearch.com/blog/pen-test-reports/ Tue, 23 Jun 2026 00:00:00 +0000 Why annual penetration tests produce the same findings, and what changes when testing is scoped around attack paths, assigned to owners with budget, and run as purple-team exercises. https://loadpathresearch.com/blog/report-phishing/ https://loadpathresearch.com/blog/report-phishing/ Fri, 05 Jun 2026 00:00:00 +0000 A suspicious email is intelligence if people feel safe reporting it, including after they clicked. Put the report button where they read mail, acknowledge every report, and never punish the reporter. https://loadpathresearch.com/blog/reading-soc2-reports/ https://loadpathresearch.com/blog/reading-soc2-reports/ Wed, 27 May 2026 00:00:00 +0000 The auditor's opinion is the least useful page. The value is in the scope, carve-outs, exceptions, period covered, and complementary user entity controls. https://loadpathresearch.com/blog/admin-rights-just-in-case/ https://loadpathresearch.com/blog/admin-rights-just-in-case/ Thu, 21 May 2026 00:00:00 +0000 Admin access granted for one task tends to stay forever, turning every phishing click or lost laptop into a bigger breach. Make elevation fast and temporary instead of permanent. https://loadpathresearch.com/blog/help-desk-authentication/ https://loadpathresearch.com/blog/help-desk-authentication/ Mon, 18 May 2026 00:00:00 +0000 Attackers call the service desk, claim to be an employee locked out of their account, and ask for a password reset or a new MFA enrollment. The help desk is measured on speed and satisfaction, which is the opposite of what verification needs. https://loadpathresearch.com/blog/break-glass-recovery-keys/ https://loadpathresearch.com/blog/break-glass-recovery-keys/ Thu, 14 May 2026 00:00:00 +0000 Emergency credentials fail when they depend on the systems they are meant to recover. How to keep break-glass accounts, recovery keys, and cloud root credentials available, protected, and tested. https://loadpathresearch.com/blog/vendor-security-questionnaire/ https://loadpathresearch.com/blog/vendor-security-questionnaire/ Thu, 30 Apr 2026 00:00:00 +0000 The standard vendor security questionnaire produces yeses, not risk insight. The questions that matter are shorter: who can access production data, which sub-processors hold it, what happened in the last incident, and what happens when you leave. https://loadpathresearch.com/blog/segmentation-inventory/ https://loadpathresearch.com/blog/segmentation-inventory/ Mon, 20 Apr 2026 00:00:00 +0000 Segmentation programs stall because nobody knows which systems talk to which, over what ports, and why. Discovery, monitoring mode, and coarse zones come before fine-grained policy. https://loadpathresearch.com/blog/zero-trust-direction/ https://loadpathresearch.com/blog/zero-trust-direction/ Mon, 13 Apr 2026 00:00:00 +0000 Zero trust deployments stall on identity cleanup, legacy applications, and organizational decisions—not on buying the next enforcement point. https://loadpathresearch.com/blog/security-awareness/ https://loadpathresearch.com/blog/security-awareness/ Wed, 08 Apr 2026 00:00:00 +0000 A polished policy on SharePoint and an annual slideshow change little when a payment-change email lands on a busy Tuesday. Short, role-specific guidance tied to real decisions does. https://loadpathresearch.com/blog/test-your-restores/ https://loadpathresearch.com/blog/test-your-restores/ Tue, 31 Mar 2026 00:00:00 +0000 A green backup job says data was saved, not that you can recover. Test a full application restore, with credentials, keys and dependencies, and time it end to end. https://loadpathresearch.com/blog/build-server-supply-chain/ https://loadpathresearch.com/blog/build-server-supply-chain/ Fri, 20 Mar 2026 00:00:00 +0000 The xz utils backdoor showed that the gap between reviewed source and deployed binary is where supply chain risk actually lives. SBOMs and scanners don't close it. https://loadpathresearch.com/blog/password-policy/ https://loadpathresearch.com/blog/password-policy/ Mon, 16 Mar 2026 00:00:00 +0000 Forced 90-day rotation and complexity rules train people into predictable passwords. Allow long passphrases, block breached passwords, drop routine expiry and pair it all with MFA. https://loadpathresearch.com/blog/ot-vs-it-security/ https://loadpathresearch.com/blog/ot-vs-it-security/ Sun, 15 Mar 2026 00:00:00 +0000 How to decide who owns OT security, how far to segment the plant network, and which security tools are safe to deploy when availability comes first. https://loadpathresearch.com/blog/acquisition-breach/ https://loadpathresearch.com/blog/acquisition-breach/ Wed, 11 Mar 2026 00:00:00 +0000 Security due diligence in M&A is usually a questionnaire. The real risk is the acquired network, its vendors, and the integration sequence that connects them to yours. https://loadpathresearch.com/blog/oauth-consent-grants/ https://loadpathresearch.com/blog/oauth-consent-grants/ Sun, 08 Mar 2026 00:00:00 +0000 OAuth grants in Microsoft Entra ID outlive trials, employees, and contracts. The directory already holds the SaaS inventory IT never built. https://loadpathresearch.com/blog/logs-you-dont-keep/ https://loadpathresearch.com/blog/logs-you-dont-keep/ Sat, 07 Mar 2026 00:00:00 +0000 Breaches are often discovered months after they start. Cloud audit logs are off by default or retained for weeks, and SIEM ingestion costs push teams to drop the noisy sources. Deciding what an investigator would need a year from now, and keeping that, even if nobody reads it until then. https://loadpathresearch.com/blog/shadow-it-symptom/ https://loadpathresearch.com/blog/shadow-it-symptom/ Fri, 06 Mar 2026 00:00:00 +0000 People adopt unapproved tools when the approved ones are too slow, too hard or missing features. Blocking the app hides the need; find it, and offer a sanctioned option quickly. https://loadpathresearch.com/blog/patching-vs-cab/ https://loadpathresearch.com/blog/patching-vs-cab/ Sat, 21 Feb 2026 00:00:00 +0000 The change process designed to prevent operational risk is now generating security risk. Tiered change authority, pre-authorized emergency paths, and peacetime decisions are the fix. https://loadpathresearch.com/blog/ransom-decision/ https://loadpathresearch.com/blog/ransom-decision/ Tue, 10 Feb 2026 00:00:00 +0000 The delegation of authority matrix in most enterprises runs from office supplies to acquisitions. It rarely has a line for extortion. This post maps the three distinct decisions in a ransomware incident—negotiate, pay, disclose—and how to assign authority before the timer starts. https://loadpathresearch.com/blog/jwts-vs-session-cookies/ https://loadpathresearch.com/blog/jwts-vs-session-cookies/ Wed, 28 Jan 2026 00:00:00 +0000 A JWT can live in a cookie and a session ID can live in browser storage. What matters is where the credential lives, how long it works, and whether you can revoke it when an account is compromised. https://loadpathresearch.com/blog/tls-decryption-gateway/ https://loadpathresearch.com/blog/tls-decryption-gateway/ Tue, 20 Jan 2026 00:00:00 +0000 A practitioner's guide to deciding which TLS traffic to decrypt at the corporate gateway, which to bypass, and who owns the liability. https://loadpathresearch.com/blog/crowdstrike-change-management/ https://loadpathresearch.com/blog/crowdstrike-change-management/ Sat, 10 Jan 2026 00:00:00 +0000 A faulty security content update took down millions of Windows machines in July 2024. The failure was not an attack. It was a kernel-level agent receiving updates outside the customer's change control, followed by a recovery that needed hands on keyboards and recovery keys at scale. https://loadpathresearch.com/blog/offboarding-security/ https://loadpathresearch.com/blog/offboarding-security/ Thu, 08 Jan 2026 00:00:00 +0000 The termination ticket closes, but the access doesn't. A practitioner's look at the shadow estate that survives offboarding: SaaS outside SSO, shared accounts, vendor portals, OAuth grants, and contractors nobody owns. https://loadpathresearch.com/blog/vercel-chains-of-trust/ https://loadpathresearch.com/blog/vercel-chains-of-trust/ Thu, 01 Jan 2026 00:00:00 +0000 The Vercel compromise shows how third-party integrations with deployment platforms become unmanaged identity providers with production access.