About Sam
Sam is a recovering penetration tester who now focuses on cloud-native defense. He likes tools that ship with sane defaults.
Sam tracks how exposure is discovered and, more importantly, how long it stays open. He keeps a running interest in the gap between a CVE announcement and the change that closes it.
Came up through incident response and vulnerability management at a cloud-native SaaS company, where the backlog was measured in tens of thousands of findings.
Latest by Sam Devlin
What one ignored S3 bucket actually costs, line by line
The financial impact of an open finding exceeds the theoretical price of a breach. Calculating the developer tax and insurance liability is the only way to fund a backlog cleanup.
One EC2 setting is generating one in seven of your cloud alerts
One in seven cloud security alerts involves failing to enforce IMDSv2, a gap that leaves temporary IAM credentials exposed to theft.
Rotating the leaked key takes 10 minutes. Finding its owner takes 3 weeks
Detection is a solved problem, but rotation remains a destructive operation. Reducing the secret backlog requires a shift from automated alerts to human-supervised remediation workflows.
Nobody touches IAM findings, because nobody wants to cause the outage
Cloud security teams face thousands of overprivileged IAM roles, but the fear of breaking production prevents remediation. Human-supervised closure is the only path to least privilege.
You closed the public S3 finding. It reopened on Monday
Cloud security teams often fix the same public S3 bucket three times in a month because manual overrides and automated scripts fail to address the underlying infrastructure-as-code drift.
The same 6 misconfigurations keep coming back. Here is the pattern
Detection tools surface thousands of alerts, but the manual effort to fix a single cloud misconfiguration still takes hours.