https://cloudsecops.com/labs Cloud and AI security research, tooling, and field guides from CloudSecOps. en https://cloudsecops.com/labs/what-we-actually-check-in-an-aws-assessment https://cloudsecops.com/labs/what-we-actually-check-in-an-aws-assessment The working method behind a CloudSecOps AWS security assessment: 69 checks organised by attack path rather than by service, the evidence request, read-only collection, a severity rubric, and why a benchmark-compliant account can still be three hops from account-wide admin. Thu, 06 Aug 2026 00:00:00 GMT https://cloudsecops.com/labs/prompt-injection-testing-methodology https://cloudsecops.com/labs/prompt-injection-testing-methodology A repeatable methodology for testing prompt injection in LLM, RAG and agent systems: rules of engagement, test matrix, trial protocols under non-determinism, severity, evidence capture and retest. Thu, 06 Aug 2026 00:00:00 GMT https://cloudsecops.com/labs/mcp-security-threat-model https://cloudsecops.com/labs/mcp-security-threat-model A threat model for Model Context Protocol deployments pinned to specification revision 2026-07-28: trust boundaries, a 41-row threat register with attacker capability and impact per row, three attack trees, and an account of what MCP declines to defend. Thu, 06 Aug 2026 00:00:00 GMT https://cloudsecops.com/labs/kubernetes-guardrails-with-opa-gatekeeper https://cloudsecops.com/labs/kubernetes-guardrails-with-opa-gatekeeper Writing the constraint is the easy part. An operational guide to running Gatekeeper as admission control you can afford to have fail: fail-open defaults, cold caches, audit blind spots, staged rollout, and the silent-drop bugs that make a green CI run mean nothing. Thu, 06 Aug 2026 00:00:00 GMT https://cloudsecops.com/labs/devsecops-practice-notes https://cloudsecops.com/labs/devsecops-practice-notes Thirty-six field notes on DevSecOps practice: pipeline identity, build provenance, secret blast radius, and vulnerability triage after NVD stopped enriching a third of new CVEs. Each note states the condition under which it stops being true. Thu, 06 Aug 2026 00:00:00 GMT https://cloudsecops.com/labs/detection-engineering-in-ai-era-clouds https://cloudsecops.com/labs/detection-engineering-in-ai-era-clouds Most evidence you need to detect attacks on AI workloads is off by default, billable, capped or sampled. A field guide to the telemetry that exists today. Thu, 06 Aug 2026 00:00:00 GMT https://cloudsecops.com/labs/automated-remediation-on-aws https://cloudsecops.com/labs/automated-remediation-on-aws An engineering guide to automated security remediation on AWS: when to automate, why an organization trail plus a service control policy removes most of the CloudTrail-disruption problem before any code runs, and how to build a loop that is idempotent, bounded, reversible and switchable-off. Thu, 06 Aug 2026 00:00:00 GMT https://cloudsecops.com/labs/ai-governance-for-engineers-not-lawyers https://cloudsecops.com/labs/ai-governance-for-engineers-not-lawyers Translate AI governance into systems you can build: inventory reconciled against runtime telemetry, deployment gates that block, human oversight you can measure, and evidence that survives review. With EU AI Act dates as amended in July 2026. Thu, 06 Aug 2026 00:00:00 GMT