A dozen years of paid break-ins. I’d like to say they were difficult. Mostly, someone had left a credential somewhere sensible and it could reach somewhere it shouldn’t, and I followed it. Compromise is usually a reachability problem. The exploit is just the part that gets the conference talk.
I still find the paths. The difference is that I’m now in the room while the system is being designed, which is cheaper for everyone. Most of the work is around the same boundaries: identity, tenants, and now the agents we deliberately hand credentials to.
I co-founded Adversis and Puck. Puck answers a question I used to answer more slowly and at a day rate: from here, what can an attacker actually reach?
There is also a book. No Starch is publishing it, so presumably there will be a robot on the cover.
Nothing new here
Every serious compromise I’ve walked through has had roughly the same plot. Usually no zero-day. A token, service account, browser extension, integration, or forgotten permission could reach more than anyone remembered granting, and the attacker discovered that before the owner did.
The distance between what something is meant to touch and what it can touch is most of the job.
Agents make that more interesting. The thing holding the credential now also reads untrusted text and decides what to do next.
The desktop agent is the new browser, except we appear to be skipping thirty years of hardening lessons and shipping it with prompt injection still unresolved.
That leaves a few problems I keep coming back to: whether grammar-constrained encoding and decoding can make agent output boring enough to trust; what intent-based access control means when the intent arrives as prose; and what happens when both sides automate.
Red teams already operate fleets of agents. The defense worth building is the one that reaches the whole fleet when the first tripwire fires, before the second host gets touched.
The other recurring problem is measurement. The industry can measure less than it pretends to, and a surprising amount of what it sells becomes less convincing once you read the research.
The short list of papers that changed my mind is on the resources page.
Tools
Give it a credential, or a pile of them from a scanner report, and it tells you whether each one is still live and what it can reach. Over a hundred credential types. Read-only by construction, with a guard test that fails if anyone adds a write path. Detection tells you a key is real; geiger tells you whether it’s dangerous.
Built with the Puck Security folks.
Audits a Tailscale network for the ACLs and settings that quietly hand out more access than anyone intended. Checks for 57 misconfigurations, and has a fix mode for when you want it to just deal with them.
Built at Adversis.
For people who
git clonefirst and ask questions later. Scans a repo, package, or install script for the signs it’s about to ruin your day, before you run it.Built at Adversis.
Lets an agent investigate endpoints over MCP, read-only, with a policy engine and an audit log in front of every command. Ask a question about your fleet in plain English and get a narrative answer with containment steps.
Built with Puck Security.
A Burp extension that finds the server actions a Next.js app is exposing, whether or not anyone meant to expose them.
Built at Adversis.
Writing
- Jan 2027 The Effective Red Team: Adversary Emulation Inside the Enterprise — No Starch Press With Trevin Edgeworth and Jordan Potti. Build a red team that turns successful attacks into better security. Early access ebook is out now; print in January 2027.
- Sep 2026 Beyond the Security OrganizationA closed-loop operating model where security evidence changes the right layer of the system and gets revalidated, instead of becoming a ticket. Also as a PDF.
- Jun 2026 Which credential do you rotate first? at Puck SecurityWhy geiger exists: scanners find keys, then leave the question open. Is it live, what does it reach, and in what order do you rotate.
- May 2026 Five findings every AI pen test walks through at AdversisIndirect injection, markdown exfil, tool abuse, cross-tenant retrieval, OAuth scope sprawl. Individually medium; together, critical.
- May 2026 Securing Claude Code for teams at AdversisPermission rules aren’t controls. Managed settings, sandboxes, and the two playbooks that scale from ten engineers to a hundred.
- Apr 2026 A demonstration of indirect prompt injection at AdversisFour poisoned documents, a seeded inbox, and an attacker console. Reproducible with cutout.
- Apr 2026 Safely use Claude Code and agent sandboxes at AdversisHooks run on the host by design. Scan first, run in a devcontainer, and default-deny egress.
Now
Fractional CISO for a handful of companies through Adversis. AI security assessments for a few more. Building Puck, which is mostly about answering “are we affected?” from the endpoints instead of from a meeting.
Email noah at this domain. Haikus get read first. Everything else gets read eventually.
Elsewhere
GitHub (@thesubtlety, and @noahpotti) · LinkedIn · Adversis · Puck Security