Engineering writing on application, cloud and supply-chain security: ASPM, SAST, SCA and SBOM, secrets, IaC, containers, CSPM, CIEM, KSPM, policy-as-code gates, compliance and vulnerability management.https://securityvault.io/enhttps://securityvault.io/blog/cloud-permission-changes-prove-access-was-reduced/https://securityvault.io/blog/cloud-permission-changes-prove-access-was-reduced/Verify cloud permission reductions with scoped access tests, session checks and fresh evidence, so an approved change becomes a defensible closure.Mon, 02 Nov 2026 00:00:00 GMTCIEMCIEMpermission changesaccess reviewremediationSujan Singhhttps://securityvault.io/blog/scanner-coverage-account-for-missing-runs/https://securityvault.io/blog/scanner-coverage-account-for-missing-runs/Review scanner coverage against expected assets, completed runs and evidence freshness, so a quiet findings queue does not conceal missing assessments.Thu, 29 Oct 2026 00:00:00 GMTVulnerability managementscanner coveragescan evidencevulnerability managementintegrationsSujan Singhhttps://securityvault.io/blog/vulnerability-exceptions-review-what-changed/https://securityvault.io/blog/vulnerability-exceptions-review-what-changed/Review vulnerability exceptions against changed assets, exposure and evidence, so a temporary acceptance does not quietly become permanent closure.Wed, 28 Oct 2026 00:00:00 GMTVulnerability managementvulnerability exceptionsrisk acceptanceremediationsecurity evidenceSujan Singhhttps://securityvault.io/blog/audit-evidence-sampling-account-for-missing-records/https://securityvault.io/blog/audit-evidence-sampling-account-for-missing-records/Build a reviewable audit evidence sample by defining its population, explaining exclusions and reconciling missing records before drawing conclusions.Tue, 27 Oct 2026 00:00:00 GMTContinuous complianceaudit evidencesamplingcontrol reviewreconciliationSujan Singhhttps://securityvault.io/blog/rollback-security-reassess-release-you-restore/https://securityvault.io/blog/rollback-security-reassess-release-you-restore/Review rollback security with exact artefact identity, current evidence and dependency checks so an older release does not inherit an outdated approval.Tue, 27 Oct 2026 00:00:00 GMTPolicy-as-code gatesrollbackrelease decisionsincident recoverysecurity evidenceSujan Singhhttps://securityvault.io/blog/vulnerability-ownership-make-team-handoffs-explicit/https://securityvault.io/blog/vulnerability-ownership-make-team-handoffs-explicit/Make vulnerability ownership transfers explicit, with acceptance criteria, escalation and retained evidence so security work survives team changes.Sun, 25 Oct 2026 00:00:00 GMTVulnerability managementvulnerability-managementownershipremediationevidenceSujan Singhhttps://securityvault.io/blog/aspm-vs-cnapp-vs-cspm/https://securityvault.io/blog/aspm-vs-cnapp-vs-cspm/ASPM vs CNAPP vs CSPM explained: where each category starts, what it covers and misses, where they overlap, and how to choose which you need first.Thu, 22 Oct 2026 00:00:00 GMTASPMaspmcnappcspmcwppcloud securitySujan Singhhttps://securityvault.io/blog/open-source-container-image-scanners/https://securityvault.io/blog/open-source-container-image-scanners/Open-source container image scanning tools compared: what Trivy, Grype, Syft and Dockle each find, where they disagree, and how to run them in CI.Thu, 22 Oct 2026 00:00:00 GMTContainer securitycontainerscontainer scanningopen sourcetrivygrypeSujan Singhhttps://securityvault.io/blog/security-logging-test-what-leaves-application/https://securityvault.io/blog/security-logging-test-what-leaves-application/Review security logging with synthetic secrets, export-path checks and failure tests while preserving useful evidence for incident investigation.Mon, 19 Oct 2026 00:00:00 GMTSecrets detectionsecretsloggingtelemetrysecurity testingSujan Singhhttps://securityvault.io/blog/ssrf-prevention-review-webhook-delivery-worker/https://securityvault.io/blog/ssrf-prevention-review-webhook-delivery-worker/Review SSRF prevention in webhook workers with destination controls, redirect handling, isolated tests and evidence for release decisions.Sat, 17 Oct 2026 00:00:00 GMTDAST & API securityssrfwebhooksapplication-securityregression-testingSujan Singhhttps://securityvault.io/blog/kubernetes-service-accounts-audit-workload-access/https://securityvault.io/blog/kubernetes-service-accounts-audit-workload-access/Audit Kubernetes service accounts by tracing token mounts, effective permissions and workload ownership, then verify that access changes work.Wed, 14 Oct 2026 00:00:00 GMTKSPMKubernetesservice accountsRBACworkload identitySujan Singhhttps://securityvault.io/blog/api-authorization-test-tenant-boundaries/https://securityvault.io/blog/api-authorization-test-tenant-boundaries/Build API authorisation tests around identity, tenant, object and action, using controlled fixtures to verify both allowed operations and denied access.Fri, 09 Oct 2026 00:00:00 GMTDAST & API securityAPI securityauthorisationtenant isolationtestingSujan Singhhttps://securityvault.io/blog/api-inventory-find-undocumented-endpoints/https://securityvault.io/blog/api-inventory-find-undocumented-endpoints/Build an API inventory from specifications, source routes and deployment evidence, then assign ownership and review undocumented or retired endpoints.Fri, 09 Oct 2026 00:00:00 GMTDAST & API securityAPI securityasset inventoryAPI driftownershipSujan Singhhttps://securityvault.io/blog/audit-evidence-freshness-review-records/https://securityvault.io/blog/audit-evidence-freshness-review-records/Assess audit evidence freshness using collection scope, change events and accountable review, so an old successful check does not imply current assurance.Fri, 09 Oct 2026 00:00:00 GMTContinuous complianceaudit evidencecontinuous compliancecontrol reviewfreshnessSujan Singhhttps://securityvault.io/blog/authenticated-dast-scan-coverage/https://securityvault.io/blog/authenticated-dast-scan-coverage/Check authenticated DAST coverage with session verification, role-specific routes and a reproducible test record before trusting a quiet scan report.Fri, 09 Oct 2026 00:00:00 GMTDAST & API securityDASTauthenticationtest coverageapplication securitySujan Singhhttps://securityvault.io/blog/build-provenance-verify-container-image/https://securityvault.io/blog/build-provenance-verify-container-image/Verify container build provenance against the image digest, trusted builder and approved source, then retain the evidence behind deployment decisions.Fri, 09 Oct 2026 00:00:00 GMTContainer securitybuild provenancecontainer securitysupply chainpolicy gatesSujan Singhhttps://securityvault.io/blog/cloud-access-review-unused-permissions/https://securityvault.io/blog/cloud-access-review-unused-permissions/Review unused cloud permissions using ownership, observation scope and tests, without confusing missing activity with proof of unnecessary access.Fri, 09 Oct 2026 00:00:00 GMTCIEMCIEMleast privilegeaccess reviewcloud identitySujan Singhhttps://securityvault.io/blog/code-to-runtime-security-coverage-checklist/https://securityvault.io/blog/code-to-runtime-security-coverage-checklist/Map code-to-runtime security across source, builds, images, deployment and running workloads, with an evidence checklist for your evaluation.Fri, 09 Oct 2026 00:00:00 GMTASPMASPMsecurity coverageruntime contextevaluationSujan Singhhttps://securityvault.io/blog/kubernetes-networkpolicy-test-isolation/https://securityvault.io/blog/kubernetes-networkpolicy-test-isolation/Verify Kubernetes NetworkPolicy with an explicit traffic matrix, allowed and denied probes, and evidence that distinguishes policy from network failure.Fri, 09 Oct 2026 00:00:00 GMTKSPMKubernetesNetworkPolicynetwork isolationverificationSujan Singhhttps://securityvault.io/blog/policy-as-code-test-release-decisions/https://securityvault.io/blog/policy-as-code-test-release-decisions/Test policy-as-code release decisions with explicit inputs, negative fixtures and failure cases before promoting a gate into the delivery workflow.Fri, 09 Oct 2026 00:00:00 GMTPolicy-as-code gatespolicy as codeOPArelease gatestestingSujan Singhhttps://securityvault.io/blog/sast-remediation-write-regression-tests/https://securityvault.io/blog/sast-remediation-write-regression-tests/Turn a SAST finding into a focused remediation test that checks the dangerous data flow, preserves valid behaviour and catches future regressions.Fri, 09 Oct 2026 00:00:00 GMTSASTSASTregression testingsecure developmentremediationSujan Singhhttps://securityvault.io/blog/sbom-diff-review-release-changes/https://securityvault.io/blog/sbom-diff-review-release-changes/Use an SBOM diff to review added, removed and changed dependencies, preserve component identity and distinguish inventory gaps from release changes.Fri, 09 Oct 2026 00:00:00 GMTSCA & SBOMSBOMdependency reviewrelease evidencesupply chainSujan Singhhttps://securityvault.io/blog/secret-rotation-verify-every-consumer/https://securityvault.io/blog/secret-rotation-verify-every-consumer/Plan secret rotation around consumer inventory, controlled cutover and revocation evidence so an updated secret does not leave old credentials usable.Fri, 09 Oct 2026 00:00:00 GMTSecrets detectionsecretscredential rotationCI securityincident responseSujan Singhhttps://securityvault.io/blog/terraform-drift-reconcile-emergency-changes/https://securityvault.io/blog/terraform-drift-reconcile-emergency-changes/Review Terraform drift after an emergency change by comparing configuration, state and live resources before choosing a controlled reconciliation.Fri, 09 Oct 2026 00:00:00 GMTIaC scanningTerraformIaC driftchange controlcloud securitySujan Singhhttps://securityvault.io/blog/vulnerability-remediation-verify-closure/https://securityvault.io/blog/vulnerability-remediation-verify-closure/Verify vulnerability remediation from source change to deployed artefact, with clear closure criteria for rescans, rollout gaps and temporary mitigation.Fri, 09 Oct 2026 00:00:00 GMTVulnerability managementremediationverificationruntime contextownershipSujan Singhhttps://securityvault.io/blog/automate-soc-2-evidence-collection/https://securityvault.io/blog/automate-soc-2-evidence-collection/Automate SOC 2 evidence collection from CI pipelines, cloud accounts and triage decisions, so Type II sampling becomes a query instead of a hunt.Sun, 04 Oct 2026 00:00:00 GMTContinuous compliancesoc-2audit-evidencecomplianceautomationci-cdSujan Singhhttps://securityvault.io/blog/how-to-evaluate-aspm-tools/https://securityvault.io/blog/how-to-evaluate-aspm-tools/How to evaluate ASPM tools on correlation, reachability, deduplication, gates, evidence and deployment model, with tests for your own proof of concept.Sun, 04 Oct 2026 00:00:00 GMTASPMASPMbuyer's guideevaluationapplication securitySujan Singhhttps://securityvault.io/blog/open-source-cspm-tools/https://securityvault.io/blog/open-source-cspm-tools/An honest guide to open-source CSPM tools: what Prowler, ScoutSuite, Cloud Custodian, Steampipe and Trivy each do, and where a correlation layer fits.Sun, 04 Oct 2026 00:00:00 GMTCSPMcspmopen sourceprowlercloud custodiancloud securitySujan Singhhttps://securityvault.io/blog/prioritize-container-vulnerabilities/https://securityvault.io/blog/prioritize-container-vulnerabilities/Prioritise container vulnerabilities with CISA KEV, FIRST EPSS, reachability and image-to-workload exposure, so the short list is what attackers would use.Sun, 04 Oct 2026 00:00:00 GMTContainer securitycontainersepsscisa kevprioritisationvulnerability managementSujan Singhhttps://securityvault.io/blog/sast-vs-sca-vs-secrets-scanning/https://securityvault.io/blog/sast-vs-sca-vs-secrets-scanning/SAST vs SCA vs secrets scanning compared: what each inspects, what it misses, when it should run and who fixes its findings, with one shared example.Sun, 04 Oct 2026 00:00:00 GMTSASTSASTSCAsecrets detectionapplication securitySujan Singhhttps://securityvault.io/blog/what-is-an-sbom/https://securityvault.io/blog/what-is-an-sbom/Learn what an SBOM contains, how CycloneDX and SPDX differ, where to generate one, and how VEX communicates product-specific vulnerability assessments.Sun, 04 Oct 2026 00:00:00 GMTSCA & SBOMsbomcyclonedxspdxvexsoftware supply chainSujan Singhhttps://securityvault.io/blog/what-is-ciem/https://securityvault.io/blog/what-is-ciem/What is CIEM? How cloud infrastructure entitlement management finds excess permissions across human and machine identities, and how it differs from IAM.Sun, 04 Oct 2026 00:00:00 GMTCIEMciemidentityleast privilegecloud securityentitlementsSujan Singhhttps://securityvault.io/blog/aspm-one-finding-graph-instead-of-five-queues/https://securityvault.io/blog/aspm-one-finding-graph-instead-of-five-queues/Correlate security findings from SAST, SCA, container, IaC and cloud scanners on one graph, so each vulnerability becomes one ranked, routed finding.Wed, 30 Sep 2026 00:00:00 GMTASPMASPMfinding correlationdeduplicationownership routingSujan Singhhttps://securityvault.io/blog/ciem-excess-privilege-as-graph-edges/https://securityvault.io/blog/ciem-excess-privilege-as-graph-edges/Find excess cloud privilege by modelling identities, roles and trust policies as graph edges you can walk, rank and cut, not rows in an access review.Wed, 30 Sep 2026 00:00:00 GMTCIEMexcess privilegeleast privilegeciementitlementsSujan Singhhttps://securityvault.io/blog/cloud-attack-paths-posture-plus-workloads/https://securityvault.io/blog/cloud-attack-paths-posture-plus-workloads/Learn how cloud attack paths chain posture, workload and identity findings into one route, so you can close the link that matters first.Wed, 30 Sep 2026 00:00:00 GMTCSPMcspmattack pathscloud securityreachabilitySujan Singhhttps://securityvault.io/blog/container-image-scanning-layers-and-base-images/https://securityvault.io/blog/container-image-scanning-layers-and-base-images/Container image scanning that separates base-image, OS package and application dependency findings, so each goes to the team that can fix it.Wed, 30 Sep 2026 00:00:00 GMTContainer securitycontainerscontainer scanningbase imagessbomSujan Singhhttps://securityvault.io/blog/continuous-compliance-evidence-not-screenshots/https://securityvault.io/blog/continuous-compliance-evidence-not-screenshots/Continuous compliance re-evaluates control status from scan evidence, so audit preparation becomes a review of signed records, not a screenshot hunt.Wed, 30 Sep 2026 00:00:00 GMTContinuous compliancecontinuous-compliancecomplianceaudit-evidenceaudit-readinessSujan Singhhttps://securityvault.io/blog/cspm-beyond-misconfiguration-lists/https://securityvault.io/blog/cspm-beyond-misconfiguration-lists/CSPM finds misconfigurations; this guide shows how ownership, exposure ranking and drift SLAs turn that list into fixes teams actually ship.Wed, 30 Sep 2026 00:00:00 GMTCSPMcspmcloud securityposture managementdriftattack pathsSujan Singhhttps://securityvault.io/blog/fail-closed-gates-why-severity-counts-fail/https://securityvault.io/blog/fail-closed-gates-why-severity-counts-fail/Fail-closed gates built on severity counts get routed around. Use reachability, exposure, ownership and recorded overrides to keep them trusted.Wed, 30 Sep 2026 00:00:00 GMTPolicy-as-code gatespolicy-gatesfail-closeddeployment-gatesreachabilityseveritySujan Singhhttps://securityvault.io/blog/framework-crosswalks-one-evidence-chain/https://securityvault.io/blog/framework-crosswalks-one-evidence-chain/Framework cross-walks help teams reuse audit evidence across shared controls while checking differences in scope, coverage and assessment requirements.Wed, 30 Sep 2026 00:00:00 GMTContinuous compliancecomplianceframework-crosswalkevidenceaudit-readinessSujan Singhhttps://securityvault.io/blog/iac-findings-to-running-resources/https://securityvault.io/blog/iac-findings-to-running-resources/IaC drift means a merged fix is not a deployed one. Link each IaC finding to the cloud resource it created and close it on evidence from the account.Wed, 30 Sep 2026 00:00:00 GMTIaC scanningiaciac driftcloud postureterraformevidenceSujan Singhhttps://securityvault.io/blog/iac-scanning-before-apply/https://securityvault.io/blog/iac-scanning-before-apply/IaC scanning catches Terraform, Kubernetes and CloudFormation misconfigurations at pull-request time, while the fix is still a one-line change.Wed, 30 Sep 2026 00:00:00 GMTIaC scanningiacterraformkubernetespolicy-as-codehelmSujan Singhhttps://securityvault.io/blog/identity-attack-paths-assumable-roles-to-data/https://securityvault.io/blog/identity-attack-paths-assumable-roles-to-data/Trace identity attack paths from a workload identity through assumable roles and trust policies to the data store it can reach, then cut one edge.Wed, 30 Sep 2026 00:00:00 GMTCIEMciemidentityattack pathstrust policiesSujan Singhhttps://securityvault.io/blog/image-to-workload-binding/https://securityvault.io/blog/image-to-workload-binding/Bind container images to workloads by digest, so vulnerabilities are prioritised by what is deployed and reachable, not by what sits in a registry.Wed, 30 Sep 2026 00:00:00 GMTContainer securitycontainerskubernetesimage digestexposureprioritisationSujan Singhhttps://securityvault.io/blog/kspm-kubernetes-posture-inventory-admission/https://securityvault.io/blog/kspm-kubernetes-posture-inventory-admission/KSPM starts with a live inventory of clusters, workloads and RBAC. Learn how inventory, topology and admission control turn posture into enforcement.Wed, 30 Sep 2026 00:00:00 GMTKSPMkspmkubernetesadmission-controlrbacinventorySujan Singhhttps://securityvault.io/blog/kubernetes-admission-gates-and-cluster-drift/https://securityvault.io/blog/kubernetes-admission-gates-and-cluster-drift/Kubernetes admission gates decide what runs, but drift undoes them. Learn what to gate on and how to keep the live cluster matching git.Wed, 30 Sep 2026 00:00:00 GMTKSPMkspmkubernetesadmission-controldriftgitopsSujan Singhhttps://securityvault.io/blog/new-cve-which-images-shipped-it/https://securityvault.io/blog/new-cve-which-images-shipped-it/Use retained SBOMs and workload links to investigate which images contain a newly disclosed vulnerability, then identify gaps that need further scanning.Wed, 30 Sep 2026 00:00:00 GMTSCA & SBOMsbomscacve-responseincident-responsecontainer-securitySujan Singhhttps://securityvault.io/blog/policy-as-code-deployment-gates-with-opa/https://securityvault.io/blog/policy-as-code-deployment-gates-with-opa/Policy as code with OPA and Rego turns deployment gates into testable rules that explain every decision at pull request, pipeline and admission.Wed, 30 Sep 2026 00:00:00 GMTPolicy-as-code gatespolicy-as-codeoparegodeployment-gatesSujan Singhhttps://securityvault.io/blog/reducing-sast-noise-without-hiding-real-bugs/https://securityvault.io/blog/reducing-sast-noise-without-hiding-real-bugs/Reduce SAST review noise with better rules, reachability context and reason-coded triage, while keeping real weaknesses visible for reassessment.Wed, 30 Sep 2026 00:00:00 GMTSASTSASTfalse positivestriagereachabilitySujan Singhhttps://securityvault.io/blog/risk-based-vulnerability-management-reachability/https://securityvault.io/blog/risk-based-vulnerability-management-reachability/Risk-based vulnerability management ranks findings by reachability and exposure, turning a thousand CVSS criticals into a short list worth fixing now.Wed, 30 Sep 2026 00:00:00 GMTVulnerability managementvulnerability-managementrisk-based-vulnerability-managementreachabilityprioritisationSujan Singhhttps://securityvault.io/blog/sast-taint-analysis-explained/https://securityvault.io/blog/sast-taint-analysis-explained/Learn how SAST taint analysis traces untrusted input from source to sink, why it beats pattern matching on noise, and where its blind spots are.Wed, 30 Sep 2026 00:00:00 GMTSASTSASTtaint analysisstatic analysisapplication securitySujan Singhhttps://securityvault.io/blog/sca-vs-sbom-what-each-answers/https://securityvault.io/blog/sca-vs-sbom-what-each-answers/SCA tells you which components are vulnerable today; an SBOM records what shipped. Learn how SCA and SBOM work together to answer advisory questions.Wed, 30 Sep 2026 00:00:00 GMTSCA & SBOMscasbomsoftware-supply-chainvulnerability-managementlicence-complianceSujan Singhhttps://securityvault.io/blog/secret-found-now-what/https://securityvault.io/blog/secret-found-now-what/Deleting a leaked secret from HEAD is not remediation. The response that works: rotate first, trace affected images, keep evidence and gate repeats.Wed, 30 Sep 2026 00:00:00 GMTSecrets detectionsecretsincident-responsecredential-rotationdeployment-gatesSujan Singhhttps://securityvault.io/blog/secrets-detection-in-git-history-and-images/https://securityvault.io/blog/secrets-detection-in-git-history-and-images/Secrets detection that only scans HEAD misses real leaks. Where credentials hide in git history, CI logs and image layers, and how to verify them safely.Wed, 30 Sep 2026 00:00:00 GMTSecrets detectionsecretssecrets-detectionappsecci-cdcontainer-securitySujan Singhhttps://securityvault.io/blog/vulnerability-ownership-routing-by-graph/https://securityvault.io/blog/vulnerability-ownership-routing-by-graph/Vulnerability ownership belongs in the graph, not a spreadsheet. Route each finding to the team that can fix it and close it on scan evidence.Wed, 30 Sep 2026 00:00:00 GMTVulnerability managementvulnerability-managementvulnerability-ownershipremediationslaSujan Singhhttps://securityvault.io/blog/what-is-aspm-application-security-posture-management/https://securityvault.io/blog/what-is-aspm-application-security-posture-management/ASPM connects scanner findings with code and deployment context, helping engineering, security and compliance teams prioritise and review remediation.Wed, 30 Sep 2026 00:00:00 GMTASPMASPMapplication securityvulnerability prioritisationrisk-based vulnerability managementSujan Singh