https://loadpathresearch.com/ https://loadpathresearch.com/articles/ https://loadpathresearch.com/articles/a-backup-system-is-not-outside-the-blast-radius/2026-09-25 https://loadpathresearch.com/articles/a-certified-chip-is-not-a-genuine-chip/2026-09-25 https://loadpathresearch.com/articles/a-clean-cve-scan-is-not-a-healthy-dependency-tree/2026-09-25 https://loadpathresearch.com/articles/a-commodity-loader-is-not-a-nuisance-infection/2026-09-25 https://loadpathresearch.com/articles/a-cve-id-is-not-a-confirmed-vulnerability/2026-09-25 https://loadpathresearch.com/articles/a-cve-is-not-your-exposure/2026-08-19 https://loadpathresearch.com/articles/a-fast-containment-time-is-not-a-good-response/2026-09-25 https://loadpathresearch.com/articles/a-flat-cloud-account-is-not-a-blast-radius-design/2026-09-25 https://loadpathresearch.com/articles/a-kms-is-not-key-management/2026-08-19 https://loadpathresearch.com/articles/a-managed-database-is-not-a-secured-database/2026-09-25 https://loadpathresearch.com/articles/a-proof-of-concept-is-not-an-exploitable-risk/2026-08-19 https://loadpathresearch.com/articles/a-residual-risk-score-is-not-evidence-a-control-works/2026-09-25 https://loadpathresearch.com/articles/a-risk-register-is-not-a-threat-model/2026-08-19 https://loadpathresearch.com/articles/a-security-tool-is-not-a-security-control/2026-08-19 https://loadpathresearch.com/articles/a-shared-top-ten-list-is-not-a-shared-root-cause/2026-09-25 https://loadpathresearch.com/articles/a-sophisticated-attacker-is-not-an-explanation/2026-09-25 https://loadpathresearch.com/articles/a-strong-cipher-is-not-a-secure-implementation/2026-09-25 https://loadpathresearch.com/articles/a-successful-login-is-not-evidence-of-a-legitimate-user/2026-09-25 https://loadpathresearch.com/articles/a-threat-actor-name-is-not-a-stable-adversary/2026-09-25 https://loadpathresearch.com/articles/a-tools-output-is-not-a-validated-finding/2026-09-25 https://loadpathresearch.com/articles/a-tpm-is-not-a-key-lifecycle/2026-08-19 https://loadpathresearch.com/articles/a-trust-boundary-is-not-an-architecture-diagram/2026-08-19 https://loadpathresearch.com/articles/a-validated-module-is-not-a-protected-key/2026-09-25 https://loadpathresearch.com/articles/a-waf-is-not-an-application-security-programme/2026-08-19 https://loadpathresearch.com/articles/an-api-gateway-is-not-an-authorization-system/2026-08-19 https://loadpathresearch.com/articles/an-average-ransom-is-not-an-expected-loss/2026-09-25 https://loadpathresearch.com/articles/an-endpoint-verdict-is-not-a-malware-identification/2026-09-25 https://loadpathresearch.com/articles/an-external-trigger-is-not-a-continuity-defense/2026-09-25 https://loadpathresearch.com/articles/an-it-only-breach-is-not-an-it-only-outage/2026-09-25 https://loadpathresearch.com/articles/an-sbom-is-not-build-provenance/2026-08-19 https://loadpathresearch.com/articles/api-authentication-does-not-stop-bola/2026-08-19 https://loadpathresearch.com/articles/apt-grade-capability-is-not-reserved-for-apts/2026-09-25 https://loadpathresearch.com/articles/authentication-does-not-authorize-anything/2026-08-19 https://loadpathresearch.com/articles/breach-lessons-are-not-a-threat-model/2026-08-19 https://loadpathresearch.com/articles/breaking-one-kill-chain-stage-does-not-stop-the-intrusion/2026-09-25 https://loadpathresearch.com/articles/cloud-shared-responsibility-does-not-configure-iam/2026-08-19 https://loadpathresearch.com/articles/containment-is-not-evidence-preservation/2026-08-19 https://loadpathresearch.com/articles/cwe-mapping-is-not-secure-code/2026-08-19 https://loadpathresearch.com/articles/database-encryption-is-not-data-minimization/2026-08-19 https://loadpathresearch.com/articles/disaster-recovery-is-not-resilience/2026-08-19 https://loadpathresearch.com/articles/encrypted-databases-do-not-replace-database-access-control/2026-08-19 https://loadpathresearch.com/articles/encryption-at-rest-is-not-data-lifecycle-control/2026-08-19 https://loadpathresearch.com/articles/fully-patched-is-not-out-of-reach-of-a-surveillance-vendor/2026-09-25 https://loadpathresearch.com/articles/immutable-backups-are-not-ransomware-recovery/2026-08-19 https://loadpathresearch.com/articles/iso-certification-is-not-a-security-architecture/2026-08-19 https://loadpathresearch.com/articles/it-network-segmentation-is-not-ot-security/2026-08-19 https://loadpathresearch.com/articles/mdm-enrollment-is-not-mobile-application-authorization/2026-08-19 https://loadpathresearch.com/articles/mitre-coverage-is-not-detection-capability/2026-08-19 https://loadpathresearch.com/articles/modeling-the-application-is-not-modeling-the-build-pipeline/2026-09-25 https://loadpathresearch.com/articles/openid-connect-login-is-not-api-authorization/2026-08-19 https://loadpathresearch.com/articles/passing-an-audit-is-not-control-effectiveness/2026-08-19 https://loadpathresearch.com/articles/pre-positioning-is-not-ransomware-with-a-different-sponsor/2026-09-25 https://loadpathresearch.com/articles/rto-and-rpo-are-not-business-continuity/2026-08-19 https://loadpathresearch.com/articles/security-of-processing-is-not-privacy-engineering/2026-09-25 https://loadpathresearch.com/articles/three-availability-zones-are-not-three-independent-failures/2026-09-25 https://loadpathresearch.com/articles/watching-the-gateway-is-not-watching-every-api/2026-09-25 https://loadpathresearch.com/articles/zero-findings-is-not-zero-flaws/2026-09-25 https://loadpathresearch.com/articles/zero-trust-does-not-abolish-network-segmentation/2026-08-19 https://loadpathresearch.com/articles/zero-trust-is-not-a-product-category/2026-08-19 https://loadpathresearch.com/articles/zero-trust-is-only-as-narrow-as-your-entitlements/2026-09-25 https://loadpathresearch.com/author/2026-09-15 https://loadpathresearch.com/author/jennifer-lin/2026-09-28 https://loadpathresearch.com/blog/ https://loadpathresearch.com/blog/acquisition-breach/2026-03-11 https://loadpathresearch.com/blog/admin-rights-just-in-case/2026-05-21 https://loadpathresearch.com/blog/backups-ransomware-target/2026-07-09 https://loadpathresearch.com/blog/break-glass-recovery-keys/2026-05-14 https://loadpathresearch.com/blog/build-server-supply-chain/2026-03-20 https://loadpathresearch.com/blog/certificate-expiry/2026-08-28 https://loadpathresearch.com/blog/crowdstrike-change-management/2026-01-10 https://loadpathresearch.com/blog/cyber-insurance/2026-09-26 https://loadpathresearch.com/blog/deletion-as-security/2026-09-25 https://loadpathresearch.com/blog/dmz-appliances/2026-09-04 https://loadpathresearch.com/blog/end-of-life-systems/2026-08-02 https://loadpathresearch.com/blog/help-desk-authentication/2026-05-18 https://loadpathresearch.com/blog/ir-plan-without-email/2026-07-23 https://loadpathresearch.com/blog/jwts-vs-session-cookies/2026-01-28 https://loadpathresearch.com/blog/logs-you-dont-keep/2026-03-07 https://loadpathresearch.com/blog/mfa-is-not-optional/2026-07-21 https://loadpathresearch.com/blog/oauth-consent-grants/2026-03-08 https://loadpathresearch.com/blog/offboarding-security/2026-01-08 https://loadpathresearch.com/blog/ot-vs-it-security/2026-03-15 https://loadpathresearch.com/blog/padlock-is-not-trust/2026-09-01 https://loadpathresearch.com/blog/passkeys-and-recovery/2026-09-25 https://loadpathresearch.com/blog/password-policy/2026-03-16 https://loadpathresearch.com/blog/patching-vs-cab/2026-02-21 https://loadpathresearch.com/blog/pen-test-reports/2026-06-23 https://loadpathresearch.com/blog/phishing-resistant-mfa/2026-09-12 https://loadpathresearch.com/blog/ransom-decision/2026-02-10 https://loadpathresearch.com/blog/reading-soc2-reports/2026-05-27 https://loadpathresearch.com/blog/report-phishing/2026-06-05 https://loadpathresearch.com/blog/restoring-active-directory/2026-07-28 https://loadpathresearch.com/blog/security-awareness/2026-04-08 https://loadpathresearch.com/blog/segmentation-inventory/2026-04-20 https://loadpathresearch.com/blog/service-accounts/2026-09-11 https://loadpathresearch.com/blog/shadow-it-symptom/2026-03-06 https://loadpathresearch.com/blog/sso-tax/2026-08-30 https://loadpathresearch.com/blog/test-your-restores/2026-03-31 https://loadpathresearch.com/blog/tls-decryption-gateway/2026-01-20 https://loadpathresearch.com/blog/vendor-security-questionnaire/2026-04-30 https://loadpathresearch.com/blog/vercel-chains-of-trust/2026-01-01 https://loadpathresearch.com/blog/wipe-the-printer/2026-07-14 https://loadpathresearch.com/blog/zero-trust-direction/2026-04-13