Enterprise IT, rewritten in real time.

Field notes on Azure, identity, security and the AI shift, from someone shipping the fixes, not just the takes.

The latest

Purview Logged What Admins Changed. Now It Logs Who Walked In. Two new audit events now capture who opened the compliance portal, eDiscovery, or Insider Risk Management, and with which role. But they won't catch the admin who never uses their privilege at…
Three Things That Break When Your Coding Agent Runs a Poisoned Model A poisoned model doesn't need a malicious pickle file to betray you. Microsoft shows how attackers embed triggers in the weights themselves, turning your coding agent into a remote shell when the…
I Tested Front Door mTLS for a Week. The CA Chain Is What Breaks. Azure Front Door can now authenticate clients with certificates in production. But the client cert isn't what fails, it's the trust chain behind it, and most teams don't upload the full CA…
Three Things That Break When You Shrink an Agent to Fit a Phone Most AI agents rent their capabilities from cloud models with billions of parameters. BotPsy runs the entire loop on your phone with no round trip, here's what survives the parameter cut and…
I Ran Google’s Decision Model for a Week. When It Earns Its Keep One thousand questions, one API call, 150ms. Google's Decision 1 does one thing only, but it might replace the expensive model you're using for half your workload.
One Brotli Decoder, Every Windows Build, and Which Systems Are Actually at Risk CVE-2026-111497 touches every Windows version, but 'every system that handles web traffic' quietly overstates your exposure. Here's how to sort your fleet by actual decompression risk and patch in the right order.
Is Your Apache Box One HTTP/2 Request Away From Someone Else’s Shell? CVE-2026-119618 is unauthenticated remote code execution on Apache 2.4.55–2.4.70 with HTTP/2 enabled. The patch shipped yesterday; here's how to audit your fleet tonight and decide who patches first.
I Pulled Exchange Custom Attributes From Graph. Here’s Where It Stops Working. Microsoft Graph finally exposes Exchange custom attributes on synchronized groups, but it's read-only and won't touch your M365 Groups. I spent a morning testing where the new API helps and where you…
The Service-Principal Governance Hack Is Dead. Agents Got Their Own Identity. AI agents used to squat in service principal clothing, ungovernable by access reviews or lifecycle workflows. Microsoft's latest Entra ID Governance update gave them their own identity class, but only some of…
Android Just Turned On Post-Quantum Crypto. Does Anything in Your Identity Stack Actually Break? Hybrid ML-KEM key exchange landed in Android via Conscrypt, designed to fail backwards when your IdP doesn't speak it. The real question isn't what breaks, it's which of your token endpoints are…
I Hunted Every Apache Server in My Azure Estate. Resource Graph Lied to Me. Resource Graph knows you have a VM. It has no idea whether Apache is running on it. When a critical RCE drops, that gap becomes your problem, here's how to inventory exposure…
Three Things That Break When You Pull a Month of Entra Sign-In Logs Your tenant now logs hundreds of thousands of authentication events daily. Here's what breaks when you try to pull all of them, and how to fix it before your next investigation.
Would You Hand a Service Principal to a Model You Can’t Vouch For? Microsoft proved that fewer than ten neuron edits can turn an AI agent into a sleeper, and your service principal comes along for the ride.

Enterprise IT, rewritten in real time.

The latest

Topics