// the attack
What broke.
One real technique, traced end to end. The surface that fails, not the headline.
> every tuesday · ~5 min · free
One real attack, walked to the defender move.
Weekly defensive engineering for cloud, CI/CD, agents, Kubernetes, and software supply-chain security. One attack traced end to end, one detection to build, one fix worth shipping.
what lands in your inbox
// the rule
What to detect.
A detection you can stand up this week. Catches the class, not just the incident.
// the move
What to ship.
One defender change worth a PR before Friday. Concrete, not a roadmap.
// the radar
What's coming.
The research and trend worth seeing before it gets loud.
latest briefings
Your Agent Runs What You Cloned.
A repo with nothing malicious in it still owns your laptop once a coding agent runs its setup step, reverse shell included.
Read briefing →
Blind Spots.
Attackers turn your cloud logs off, then read the same pipeline for recon. Assume your visibility has holes, then find which detection breaks.
Read briefing →
Untrusted by Invitation.
Trail of Bits walks four malicious agent skills past every commercial scanner. The agent era moves trust to both ends of the wire.
Read briefing →who writes this
R.K. Chidambaram
Cloud security engineer · Toronto · 15+ years
AWS and Kubernetes, IAM, detection engineering, CI/CD and supply-chain security. Weekly Recon is the brief I'd want in my own inbox: one attack worth knowing, one rule worth building, one defender move worth shipping.
more from defensive.works
// cloud supply-chain CTF
Labs.
TeamPCP Goat: a vulnerable AWS environment with 6 supply-chain flags across 2 modules. Free, self-hosted.
// cloud security thrillers
Books.
Thrillers where every CloudTrail event is real. Assumed Role and Signed & Sealed. Free PDFs.
// the teampcp files
Comics.
Visual explainers on real cloud-security attacks. Episode 01: The TanStack Heist.
> every tuesday · 09:00 ET
Get the next brief in your inbox.
One real attack, walked to the defender move. Reply-friendly.