One attack surface at a time, from the Identity pillar outward.
Practitioner research by Tom Stacy, CISSP®. It started with authentication attack chains — the Identity pillar of Zero Trust. It continues across all five pillars, with one thread running through everything: where PII and secrets actually leak, and how to stop them.
The Zero Trust model, one pillar at a time
CISA's Zero Trust Maturity Model frames security across five core technology pillars. This site builds the practitioner view of each — how they break, and where PII redaction fits inside them.
Identity
Where this site began. OAuth, OIDC, SAML, session abuse, MFA bypass — the attack chains that prove identity is the perimeter.
Identity research →Devices
Endpoint telemetry, MDM data, and device logs — and the PII they carry into your data lake.
Devices →Applications
API payloads, support tickets, RAG pipelines, LLM prompts. The new redaction frontier.
Applications →Data
DLP, masking, tokenization, verified-clean redaction. The crown jewel and the final wall.
Data →Visibility & Automation
SIEM pipelines, SOAR playbooks, policy-as-code. Where redaction rules become systemic.
Visibility & Automation →Latest research
The Identity pillar archive — every technique reproduced against FlawedToken, with logs, conditions, and fixes.
The Gap Nobody Talks About: From "OAuth Is Attackable" to "Here's the Proof"
The series intro: why practitioner proof matters, and the reframe from auth flows to the full Zero Trust model.
2026-05-22OAuth Authorization Code Interception: The Flow, the Seam, and What Your Logs Actually Show
Authorization code interception end-to-end, reproducible against FlawedToken.
2026-07-11Redirect URI Manipulation: Stealing the Authorization Code at the Door
The load-bearing control that fails quietly — a walkthrough against a real vulnerable client.
2026-05-29The Local Lab Blueprint: Building an Isolated, Scriptable Interception Lab
A reproducible containerized interception lab — mitmproxy, Docker, browser session isolation.
The redaction thread
PII redaction isn't a Data-pillar problem. It threads through every pillar — identity artifacts in auth logs, secrets in device telemetry, customer data in LLM prompts. This site documents the whole surface, and ShroudCloud builds the detection engine for it.
| Pillar | Where PII hides | Redaction play |
|---|---|---|
| Identity | Auth logs, SSO audit, session records | JWTs, OAuth codes, bearer tokens |
| Devices | Endpoint telemetry, MDM inventory | Device logs scrubbed before the lake |
| Networks | DNS, NetFlow, mail gateway logs | Identifiers stripped from metadata |
| Applications | API payloads, tickets, LLM prompts | Shroud before the model sees it |
| Data | Documents, databases, DLP pipelines | Verified-clean export with audit trail |