Articles
Articles and observations from building an attack-path engine
What went wrong during PerspectiveGraph development, how I found out, and what I changed. Each one also affirms what it does not prove.
12 October 2026 · 8 min read
Two scanners agreed, and the code was not in my binary
A scan of the web server my project builds reported a High-severity vulnerability in its HTTP/2 library. A second scanner, one that checks which functions a program actually calls, confirmed the vulnerability and found four more. I drafted the release note warning operators that anyone on the internet could take down their dashboard. I then checked the binary and discovered that the vulnerable server was not present.
12 October 2026 · 7 min read
AWS now traces the IAM part of my attack paths
In July, AWS Security Hub started tracing privilege escalation chains from exposed resources. Within an AWS account, this is the question my engine was designed to answer, and AWS partially addresses this question with policy logic that my engine does not read. Here is what AWS does better, what its documentation does not describe, and where I have moved my work.
12 October 2026 · 6 min read
One shipped, one shelved: two changes to how my engine counts evidence
Two changes to how my engine weighs evidence, proposed on the same day. Both sounded reasonable. One fixed a real bug - a vulnerability counted as two opportunities for an attacker - and was implemented within a few hours. I evaluated the other before writing it, and the data advised against implementing it.
12 October 2026 · 10 min read
Same name, different thing: five identity bugs in my attack-path engine
An attack-path engine combines data from multiple tools into a single graph, with each tool assigning different names to the elements. If it cannot recognize that two names have the same meaning, the actual paths break down. If it interprets two different elements as a single one, it generates nonexistent paths. I found five places where my engine made this mistake - and in three of them, it created nonexistent paths.
12 October 2026 · 7 min read
The pull request that passed clean because of a file name
My engine's merge check has three responses: clean, blocked, and unknown. The third exists so that a pull request nobody analyzed cannot get the same green checkmark as a safe one. A pull request whose image was on a path from the internet to a sensitive asset still got the green checkmark. The scan had arrived on time and intact. It wasn't attached to anything, due to a file name.
12 October 2026 · 10 min read
The false positive AWS found in my own engine
My open source engine, PerspectiveGraph, reported that a role in my AWS account could make itself administrator. It could not: a permissions boundary stopped it, and the engine had never read the boundary. I did not find this by reading my code. AWS told me.