Security is a claim.
Evidence is the product.
Security incidents, identity engineering, and the integrity of audit trails — written for the people who have to make systems provable.
-
Coder registry compromise: the origin pool was the identity
Attackers joined the Cloudflare pool behind Coder's module registry and served credential-stealing Terraform modules. TLS held. The trust behind it didn't.
-
The agent handed over its API key, and the logs looked normal
Attackers prompted a METR agent into revealing its API key, then spent about $600,000 in model credits over three weeks inside normal-looking evaluation traffic.
-
Three unauthenticated CVSS 10s in the system that approves access
ServiceNow patched three unauthenticated CVSS 10.0 flaws. When the platform that records approvals is writable before login, its records become claims to verify.
-
The forged SAML login your logs will call legitimate
Actively exploited miniOrange SAML bypasses (CVE-2026-15981, CVE-2026-61979) forge admin logins the IdP never saw and version scanners called patched.
-
Your agent's action is logged. Its reason is gone.
Agent audit trails record the tool call and drop everything the agent read before making it. The reason lived in a context window nobody kept.
-
The audit log will say the admin did it
CISA's Metasys advisory (CVE-2026-34491) describes low-privilege XSS that executes in admin sessions. Every action it takes will be logged as the admin.
-
The passkeys held. The signals around them didn't.
Three August research releases defeated passkeys without breaking the cryptography. Each broke the plumbing around the key: logging, binding, and the audit trail.
-
MFA ends at login. Account takeover doesn't.
The login ceremony gets hardware keys and biometrics. Everything after it rides on a cookie. The session, not the password, is where takeover happens now.
-
Retention is an engineering problem wearing a policy costume
Keep for seven years, delete after ninety days — both halves of a retention policy are provable engineering claims, and most systems can prove neither.
-
The vendor security review has started asking for proof
Enterprise buyers used to ask whether you kept audit logs. Now they ask who can edit them. What changed in procurement, and what to have ready before the deal.
-
Service accounts never offboard
Every human identity gets a leaving day. Machine identities are created, granted, and forgotten — and access reviews rarely list them. The gap is structural.
-
Your audit log is a story, not evidence
Most audit trails are rows in a table the operator can edit. That gap stays invisible until the day it matters — and by then the log is all anyone has.