Posts

For years, if you ran a private company in Saudi Arabia, the National Cybersecurity Authority’s (NCA) controls were something you admired from a distance. They applied to government entities and critical national infrastructure operators. If you weren’t in those categories, you could read the frameworks, nod along, and carry on. That era just ended. In December 2025, the NCA published NCNICC-1:2025, the Non-Critical National Information Infrastructure Cybersecurity Controls. It took effect in January 2026. And for the first time, a binding NCA framework now applies directly to the general private sector. If you run a private company in the Kingdom, this is now your problem to solve, not someone else’s. ...

Everyone is shouting about AI in security. Vendors promise “AI-powered threat detection” on every slide deck. LinkedIn gurus claim AI will replace the entire SOC. And then there’s the other extreme: the purists who insist AI has no place in security at all. I use AI every single day for security work, and the truth sits somewhere boring: it’s a great tool for some things, a dangerous crutch for others, and knowing the difference is the whole game. Here’s the honest take from someone who actually runs it daily. ...

If you’ve spent any time working with AI coding assistants, you’ve probably hit the same wall: they’re great at generating one-off snippets, but trying to use them for a real project that spans days or weeks? It falls apart. Context gets lost. Plans drift. You end up repeating yourself over and over. The dream of “just tell the AI what to build and ship it” dies somewhere between the third context reset and the tenth broken import. ...

Your Azure infrastructure isn’t just a list of names in a spreadsheet; it’s a living, breathing network of interconnected services. So why are you still trying to understand it by scrolling through a flat CSV file? The complexity of modern cloud environments means that seeing the “big picture” how resources relate to each other and to the outside world is more critical than ever, yet often feels impossible. In this post, we’ll introduce a powerful open-source tool, the Cloud Visualizer (CAV), that transforms that boring data export into a rich, interactive graph. We’ll show you exactly how to go from a raw CSV file to a fully explorable map of your cloud, and how to uncover security insights you might have otherwise missed. ...

Introduction: Overprivileged Accounts Are a Hidden Risk In Google Cloud, service accounts are the backbone of automation, enabling applications and scripts to interact securely with cloud resources. But when a service account has more privileges than necessary, it becomes a ticking time bomb a single compromised account can lead to data leaks, resource misuse, or lateral movement across your cloud environment. This post dives into how to enforce the Principle of Least Privilege (PoLP) for Google Cloud service accounts, with actionable examples and best practices that even experienced cloud architects will find indispensable. ...

I’ve lost count of how many times I’ve heard someone say “our cloud is secure” right before finding a bucket wide open to the internet. Here’s the thing - most people aren’t lying when they say that. They genuinely believe their environment is locked down. And then you run a quick scan and find 50 misconfigurations you never knew existed. That’s the cloud security problem in a nutshell. You don’t know what you don’t know. ...