Writing & Research
I question things in security that have become conventional wisdom
I try to take claims the security industry repeats, go back to the primary sources, and work out what the evidence actually supports. Sometimes the answer is less clear than I expected, and a few of these papers end without a firm conclusion.
These are summaries of the work. Behind each one is a longer paper with the claims I checked and dated copies of the sources I used.
If you want to read one, just ask.
26 summaries
Why Is Broken Access Control Still Broken?
Whether access control correctness depends on facts only the application knows, tested against a coded sample of 2025 authorisation advisories and their fixes.
Read summary →What Is the Point of a CVSS Base Score?
What the specification says a base score represents, and what 380,000 NVD records and the CISA KEV catalogue show it distinguishes
Read summary →Are Security Headers and Content Security Policy Security Theatre?
What deployed headers are specified to do, what 1,266 reachable sites actually send, and what the evidence says about attack outcomes
Read summary →Have modern frameworks made applications safer?
What framework defaults have and have not removed, tested against framework documentation and published advisory data
Read summary →CVSS, EPSS and KEV: which helps prioritisation, and at what cost?
What each of three public signals covers, what ordering by each would produce, and what public data can and cannot settle about their relative value
Read summary →What a Vulnerability Count Can and Cannot Tell You
What a finding count does and does not license
Read summary →Can a Defender Act on a CVE Record?
A preregistered rubric study of 100 CVE records published June to August 2026
Read summary →Does continuous control monitoring measure security?
What compliance automation tests check, how often, and what the platforms themselves say the monitoring does not cover
Read summary →Is the OWASP Top 10 Still Relevant? A look at the 2025 edition's own method and data
What the 2025 edition's own published method and data support, and where the reporting of it, OWASP's included, fails to match the source.
Read summary →Do CVE Counts Measure Insecurity or Researcher Attention?
Whether the count measures the software, or how many people looked at the software and how their findings were turned into records
Read summary →SSRF After Its Demotion
A desk study of the OWASP Top Ten 2025 decision to fold Server-Side Request Forgery into Broken Access Control, set against the advisory, exploitation and cloud-hardening record
Read summary →What does Zero Trust actually claim, and what can be tested?
What the published definitions commit an implementer to, which of those commitments could be tested, and whether any have been tested against incident or attack-path outcomes
Read summary →How Published Security Reports Justify Critical and High Ratings: a Coded Sample of 20 Reports, 16 of Them Code or Smart-Contract Audits
What a published report offers the reader to support a Critical or High rating
Read summary →Identity as Blast Radius: Human and Non-Human
A desk study with incident coding. It examines how far identity compromise propagates in the public record, with attention to service accounts, machine credentials and third-party OAuth grants.
Read summary →The Cost of AI Noise in Vulnerability Reporting
Whether reports produced with generative AI tools shift cost onto the maintainers who receive them, and what projects have changed in response
Read summary →Does Memory Safety Deliver What It Promises?
Google's Android reporting and Microsoft's 70% figure, compared with their secondary restatements
Read summary →Does Vulnerability Scanning Find What Attackers Exploit?
A coverage analysis of two open-source scanners against the CISA Known Exploited Vulnerabilities catalogue and public incident reporting
Read summary →Busy Security: When Security Activity Substitutes for Security Outcomes
Is security work easier to count than risk reduction? This paper tests what the published evidence says.
Read summary →Do OWASP's LLM and Agentic Top 10s Describe Observed Failures?
A test of whether the lists' categories map onto the failures that have actually been documented in public
Read summary →Has MFA, and now passkeys, solved account takeover?
Which attack paths MFA and phishing-resistant factors close, and which they leave open
Read summary →Is the AI Security Industry Testing the Wrong Things?
Whether testing aimed at what a model can be made to say leaves what a deployed agent is permitted to do under-examined
Read summary →How Many of Your Dependency CVEs Can Actually Reach You?
A preregistered replication in Go: govulncheck's call-graph analysis against dependency-level findings on 105 modules from the Go module index, with a hand check of 40 findings
Read summary →The Green Dashboard Fallacy
Whether control-status scores measure exposure to what attackers actually exploit
Read summary →SOC 2: Security Assurance or Procurement Passport?
What a SOC 2 type 2 report asserts, what the audited organisation chooses to put in scope, and what published evidence shows about incidents and about how reports are read
Read summary →Is 'Misconfiguration' a Useful Root Cause?
What seventeen public incident write-ups and regulator findings show about defaults, guardrails, operator action and documentation behind the label
Read summary →The 80/20 Security Programme
Which small set of controls has published evidence behind it, how strong that evidence is in each direction, and what the CISA Known Exploited Vulnerabilities catalogue can and cannot say about initial access
Read summary →