https://aaronormerod.com weekly 1 https://aaronormerod.com/contact monthly 0.7 https://aaronormerod.com/writing 2026-09-29T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/ai-governance-critical-infrastructure monthly 0.7 https://aaronormerod.com/writing/why-is-broken-access-control-still-broken 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/what-is-the-point-of-a-cvss-base-score 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/are-security-headers-and-content-security-policy-security-theatre 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/have-modern-frameworks-made-applications-safer 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/cvss-epss-and-kev-which-helps-prioritisation-and-at-what-cost 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/what-a-vulnerability-count-can-and-cannot-tell-you 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/can-a-defender-act-on-a-cve-record 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/does-continuous-control-monitoring-measure-security 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/is-the-owasp-top-10-still-relevant 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/do-cve-counts-measure-insecurity-or-researcher-attention 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/ssrf-after-its-demotion 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/what-does-zero-trust-actually-claim-and-what-can-be-tested 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/how-security-reports-justify-critical-ratings 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/identity-as-blast-radius 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/the-cost-of-ai-noise-in-vulnerability-reporting 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/does-memory-safety-deliver-what-it-promises 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/does-vulnerability-scanning-find-what-attackers-exploit 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/busy-security-when-security-activity-substitutes-for-security-outcomes 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/do-owasps-llm-and-agentic-top-10s-describe-observed-failures 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/has-mfa-and-now-passkeys-solved-account-takeover 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/is-the-ai-security-industry-testing-the-wrong-things 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/how-many-of-your-dependency-cves-can-actually-reach-you 2026-09-29T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/the-green-dashboard-fallacy 2026-09-25T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/soc-2-security-assurance-or-procurement-passport 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/is-misconfiguration-a-useful-root-cause 2026-09-28T00:00:00.000Z monthly 0.7 https://aaronormerod.com/writing/the-80-20-security-programme 2026-09-28T00:00:00.000Z monthly 0.7