The Hidden Port

CVSS alone doesn't tell engineering what to work on first.

How I designed the scanner surface for a fully custom, budget-constrained vulnerability management program — coverage decisions, deduplication via DefectDojo custom selectors, EPSS + tag-based prioritization, and why I ended up building my own secrets sca…

The real risk with AI agents accessing AWS isn't prompt injection — it's the combination of AI without context, engineers acting without full understanding, and autonomous mode.

Most vulnerability management programs fail from the same handful of design mistakes — CVSS-only prioritization, security owning the fix queue, unilateral SLAs, and no feedback loop with engineering.

AWS Identity Center can now be provisioned without pushing the service-linked role into every member account.

The AWS evidence requests that show up in real ISO 27001 audits — log retention proofs, access control evidence, past investigation examples, and DR tests.

Permission boundaries let you scope individual IAM identities in ways SCPs can't.

Security Hub now has an MCP server for Claude Desktop.

Standard GuardDuty watches network traffic.

Secrets Manager now publishes secret change events to EventBridge automatically — no CloudTrail workarounds needed.

GuardDuty detects threats.

A real spearphishing incident I handled from ticket to remediation.

Practical guide to analyzing AWS CloudTrail logs — Athena queries for tracing non-compliant resources, finding who opened SSH to the world, and building your investigation workflow.

Practical AWS Service Control Policies for real organizations.

Why AWS IAM users are obsolete in 2026 - and how to implement secure, scalable alternatives with Identity Center, OIDC, and temporary credentials.

Most EKS clusters run with default RBAC, no network policies, and pods with root.

The baseline I verify on every AWS security engagement — 10 checks with CLI commands covering IAM, S3, logging, and network hardening.

The same 5 AWS misconfigurations show up in every audit I run.

Handle real AWS security incidents step by step.

What AmazonSSMManagedInstanceCore actually permits, when to use it for Session Manager, and how to build a scoped-down custom policy for production.

Step-by-step guidance on meeting CIS Benchmarks for EC2 in AWS.

Most EKS clusters ship with control plane logging off and no runtime detection.

How to prepare for eJPTv2 when your background is cloud security, not pentesting.

One hunter reported 220 IDOR finds in a single year.

Enable GuardDuty, filter noisy findings by severity, and wire EventBridge alerts to Slack or your SIEM — with Terraform and Console steps.

How to detect IAM privilege escalation in AWS using CloudTrail events, EventBridge rules, and real-world API patterns.

Audit and tighten IAM permissions using Access Analyzer, CloudTrail, and service last-accessed data.

Build a CIS-compliant Amazon Linux 2 AMI using EC2 Image Builder.

Step-by-step SSM Session Manager setup — IAM role, AmazonSSMManagedInstanceCore policy, instance profile, and session logging.

Harden EC2 instances with IAM least privilege, OS lockdown, encryption, logging, and CIS benchmark checks.

Free toolkit with an IR playbook template, Terraform-deployed notification pipeline, Lambda functions for SES and Slack alerts, and a forensic tool matrix — everything you need to respond to AWS security incidents.

Build real AWS threat detection with GuardDuty, CloudTrail, EventBridge, and Wazuh — without Splunk or Datadog.

Kill long-term AWS access keys for good.

Most small teams write an IR plan and never test it.

How I passed the AWS Security Specialty (SCS-C02) exam.

Disclaimer regarding affiliate links and content on The Hidden Port.

Browse all articles grouped by category.

Step-by-step root account detection with EventBridge, SNS, and Slack alerts — CLI commands and Terraform included.

Generate least-privilege IAM policies automatically from CloudTrail activity using Access Analyzer, then deploy them with Terraform.