Projects

Offboarding workflow model that tracks every access path an identity holds across identity provider, network, cloud keys, tokens, MFA enrolment, non-SSO SaaS, endpoint, and physical badge, computing the residual access window rather than assuming one account disable is sufficient.

Live threat-intelligence visualization that plots inbound attack origins on a world map, streams a feed of enriched IOCs, and ranks the most active malicious source regions.

Screening model that evaluates a resume against a role's requirements with alias and adjacent-tool matching, treating required items as gates rather than score contributions, and returning each unmatched requirement as a specific thing to evidence or to build.

Certification study planner that allocates a finite study budget across exam domains by exam weight, knowledge gap, and retention decay since the last review, projecting readiness at the exam date rather than producing a flat topic checklist.

Policy simulator that evaluates password rules against real cracking economics, modelling how composition requirements and forced rotation reduce effective entropy, how hash choice moves guess rate by orders of magnitude, and what share of an organisation falls in a 24-hour offline attack.

API security review model that inventories endpoints and checks each for object-level authorisation on client-supplied ids, function-level authorisation on privileged routes, mass assignment, unauthenticated writes, and unbounded authentication paths.

Log pipeline economics model that routes each telemetry source to index, field-filter, archive, or drop, then reports monthly ingest cost against value-weighted detection coverage and names exactly which detections each saving gives up.

Incident communication planner that derives severity from which of confidentiality, integrity, and availability are affected at what scale, then computes regulatory notification deadlines separately and orders every audience with the content each one should receive.

Sensitive data classifier that pairs each detector with a checksum or a context anchor (Luhn validation for card numbers, label anchoring for record numbers and dates of birth), derives a document classification from the strongest category found, and renders an in-place redacted view.

Backup verification model that tests each system's claimed recovery objectives against reality: interval versus RPO, measured restore duration versus RTO, immutability under a ransomware scenario, and how stale the last successful restore test is.

Kubernetes admission controller model that evaluates pod specifications against the restricted Pod Security Standard plus operational rules, rendering deny, warn, and pass verdicts with the enforcement and audit-mode difference made explicit.

Authentication log analyser that detects MFA fatigue attacks from the signature pattern of repeated rejected push prompts ending in an approval, weighted by device enrolment status, source ASN classification, and geographic baseline deviation.

Phishing simulation planner that models click rate, credential submission, and report rate per department across lure difficulty and completed training cycles, foregrounding credential entry on privileged accounts rather than raw click counts.

Web application firewall rule laboratory that runs attack payloads and legitimate traffic through three rule generations, showing how literal keyword matching is defeated by inline comments and why parameter context is what finally removes the false positives.

Container image auditor that grades base image currency, root execution, added Linux capabilities, layer-embedded secrets, digest pinning, and package CVEs, then renders the admission decision a gate would make.

Permission drift analyser that compares granted entitlements against 90 days of observed usage per identity, surfacing dormant accounts with live credentials, wildcard grants, IAM self-escalation paths, and the specific permissions safe to remove.

Repository secret scanner that reports exposure window and blast radius per finding, distinguishing values still in the working tree from values reachable only in pushed history, and drives a rotation-first remediation sequence rather than a history rewrite.

Transport security grader that evaluates offered protocol versions, cipher suite properties, key type and size, certificate expiry and chain completeness, HSTS strength, and OCSP stapling, producing a letter grade with a named mechanism and fix per finding.

Vulnerability prioritisation engine that scores findings as likelihood times impact, drawing likelihood from EPSS and known-exploited status and impact from asset exposure and tier, then assigns remediation SLAs and shows how badly a CVSS-only sort misorders the queue.

Behavioural detection model that scores five-second windows of file activity on write volume, write entropy, in-place rename bursts, canary file access, and shadow copy deletion, then triggers containment and reports how many files were lost before it fired.

DNS telemetry analyser that scores queries on label entropy, label length, NXDOMAIN response rate, and per-zone query volume to separate domain-generation algorithms and DNS tunnelling from ordinary resolution, with tunable thresholds.

Attack-economics model for credential stuffing that composes rate limiting, account backoff, breached-password screening, risk-based challenges, device fingerprinting, and MFA, quantifying both the takeovers prevented and the legitimate users inconvenienced.

Detection authoring and regression workbench that evaluates Sigma-style rules against a labelled event corpus, reporting precision, recall, and per-event outcomes so the cost of broadening a condition is measurable instead of assumed.

Streaming log analytics that establishes a rolling baseline, computes z-scores on event rates, and surfaces statistical anomalies in real time before they become incidents.

Paste an AWS IAM policy and CloudGuard audits it for wildcard actions, privilege-escalation paths, public exposure, and missing conditions, scoring least-privilege compliance.

Simulated reconnaissance tool that sweeps a target host, fingerprints open services and versions, and flags risky exposed ports the way Nmap would in a live engagement.

Lightweight identity provider that signs, decodes, and verifies JSON Web Tokens with HMAC-SHA256, demonstrating tamper detection and expiry handling end to end.

Paste a raw email and PhishGuard inspects SPF/DKIM alignment, sender spoofing, link domains, and social-engineering language to produce a weighted phishing verdict.

Real-time SOC console that ingests alerts, correlates them against MITRE ATT&CK techniques, scores severity, and drives an analyst triage queue with acknowledge/escalate workflows.