A dozen years of paid break-ins. I would like to report that they were hard. Mostly someone had left a credential somewhere reasonable and it reached somewhere unreasonable, and I walked. Compromise is a reachability problem. The exploit is the part that gets the conference talk.
I still find the paths. The difference is that I’m now in the room when the system gets designed, which is cheaper for everyone. Mostly that means the boundaries around identity, tenants, and the agents we now give credentials to on purpose. Co-founder at Adversis and Puck, which answers what an attacker can actually reach from here, a question I used to answer more slowly and at a day rate. There is a book. No Starch is publishing it, which means it will have a robot on the cover.
Nothing new here
Every bad compromise I’ve walked through had the same plot. No zero-day. Something, a token, a service account, a browser extension, an integration, could reach more than anyone remembered granting, and the attacker found that out first.
The distance between what a thing is supposed to touch and what it can touch is most of my job now. Agents make it more interesting: the thing holding the credential now reads untrusted text and decides what to do next.
The agent on the desktop is the new browser, minus thirty years of hardening lessons, and it ships with prompt injection unsolved. The parts I find myself poking at: whether grammar-constrained encoding and decoding can make an agent’s output boring enough to trust, what intent-based access control looks like when the intent arrives as prose, and what happens once both sides automate. Red teams already drive fleets of agents. The defense worth building is the one that rolls out to the whole fleet at the first tripwire, before the second host is touched.
The other thing I keep noticing is that the industry can’t measure much of anything, and that most of what it sells doesn’t survive contact with the research. The short list of papers that convinced me is on the resources page.
Tools
Give it a credential, or a pile of them from a scanner report, and it tells you whether each one is still live and what it can reach. Over a hundred credential types. Read-only by construction, with a guard test that fails if anyone adds a write path. Detection tells you a key is real; geiger tells you whether it’s dangerous.
Built with the Puck Security folks.
Audits a Tailscale network for the ACLs and settings that quietly hand out more access than anyone intended. Checks for 57 misconfigurations, and has a fix mode for when you want it to just deal with them.
Built at Adversis.
For people who
git clonefirst and ask questions later. Scans a repo, package, or install script for the signs it’s about to ruin your day, before you run it.Built at Adversis.
Lets an agent investigate endpoints over MCP, read-only, with a policy engine and an audit log in front of every command. Ask a question about your fleet in plain English and get a narrative answer with containment steps.
Built with Puck Security.
A Burp extension that finds the server actions a Next.js app is exposing, whether or not anyone meant to expose them.
Built at Adversis.
Writing
- Jan 2027 The Effective Red Team: Adversary Emulation Inside the Enterprise — No Starch Press With Trevin Edgeworth and Jordan Potti. Build a red team that turns successful attacks into better security. Early access ebook is out now; print in January 2027.
- Jun 2026 Which credential do you rotate first? at Puck SecurityWhy geiger exists: scanners find keys, then leave the question open. Is it live, what does it reach, and in what order do you rotate.
- May 2026 Five findings every AI pen test walks through at AdversisIndirect injection, markdown exfil, tool abuse, cross-tenant retrieval, OAuth scope sprawl. Individually medium; together, critical.
- May 2026 Securing Claude Code for teams at AdversisPermission rules aren’t controls. Managed settings, sandboxes, and the two playbooks that scale from ten engineers to a hundred.
- Apr 2026 A demonstration of indirect prompt injection at AdversisFour poisoned documents, a seeded inbox, and an attacker console. Reproducible with cutout.
- Apr 2026 Safely use Claude Code and agent sandboxes at AdversisHooks run on the host by design. Scan first, run in a devcontainer, and default-deny egress.
- Apr 2026 What I keep finding on the way to your crown jewels at Puck SecurityBreaches rarely start with a zero-day. They start with a credential that was already on a developer’s laptop, and nobody knew what it could reach.
Now
Fractional CISO for a handful of companies through Adversis. AI security assessments for a few more. Building Puck, which is mostly about answering “are we affected?” from the endpoints instead of from a meeting.
Email noah at this domain. Haikus get read first. Everything else gets read eventually.
Elsewhere
GitHub (@thesubtlety, and @noahpotti) · LinkedIn · Adversis · Puck Security