Application security insights

Christian Schneider · 29 Apr 2026 · 17 min read The invisible explosion This post is part of my series on securing agentic AI systems, covering attack surfaces, defense patterns, and threat modeling for AI agents.

Christian Schneider · 08 Apr 2026 · 16 min read The verification gap This post is part of my series on securing agentic AI systems, covering attack surfaces, defense patterns, and threat modeling for AI agents.

Christian Schneider · 11 Mar 2026 · 18 min read The invisible instructions This post is part of my series on securing agentic AI systems, covering attack surfaces, defense patterns, and threat modeling for AI agents.

Christian Schneider · 04 Mar 2026 · 16 min read A third class of lateral movement This post is part of my series on securing agentic AI systems, covering attack surfaces, defense patterns, and threat modeling for AI agents.

Christian Schneider · 26 Feb 2026 · 14 min read From session attacks to persistent compromise This post is part of my series on securing agentic AI systems, covering attack surfaces, defense patterns, and threat modeling for AI agents.

Christian Schneider · 19 Feb 2026 · 12 min read The trust paradox in RAG systems This post is part of my series on securing agentic AI systems, covering attack surfaces, defense patterns, and threat modeling for AI agents.

Christian Schneider · 12 Feb 2026 · 37 min read Why MCP security is different This post is part of my series on securing agentic AI systems, covering attack surfaces, defense patterns, and threat modeling for AI agents.

Christian Schneider · 05 Feb 2026 · 26 min read Why traditional threat modeling falls short This post is part of my series on securing agentic AI systems, covering attack surfaces, defense patterns, and threat modeling for AI agents.

Christian Schneider · 29 Jan 2026 · 15 min read Agentic AI attack chains This post is part of my series on securing agentic AI systems, covering attack surfaces, defense patterns, and threat modeling for AI agents.

Christian Schneider · 27 Jan 2026 · 28 min read The golden hour problem TL;DR Most supply chain attacks, including short-lived campaigns like the Nx incident and the recent wormable Shai-Hulud incarnations, exploit a narrow window between malicious package

Christian Schneider · 24 Jan 2026 · 10 min read Attack surfaces inside CI/CD TL;DR Your CI/CD pipelines have become high-leverage attack targets—not your application code.

Christian Schneider · 13 Apr 2024 · 20 min read Secure software development TL;DR Drawing from my experience conducting OWASP SAMM assessments and DevSecOps implementations across dozens of organizations, I’ve identified 12 technical leverage points that…

Christian Schneider · 20 Oct 2023 · 5 min read Micro Attack Simulations TL;DR While organizations with mature security programs benefit from full Red Team and Purple Team exercises, many organizations building their security capabilities need a more acces…