Security architecture, from the endpoint outward.
I secured the perimeter; then the data pipeline. Now I work where attackers actually land — the runtime, the worker process, and the detection gap around them. Practitioner research by Tom Stacy, CISSP®, an endpoint security architect who has done this at IBM Security, CrowdStrike, and Trend Micro.
The endpoint, three ways
Auth flows decide who gets in. The endpoint decides what happens after they do — and that is where the interesting failures live.
The runtime is the host
A web-facing exploit is an endpoint problem. The interpreter, the worker process that executes it, the privileges it inherits — that is a host story your EDR may never have classified as one.
Why the endpoint →Detection's blind spot
The quiet HTTP 200. The request that arrives after the code has already run. The thing that should have fired and didn't — and the log line that tells you so, if anyone reads it.
The detection gap →Coverage as evidence
Detection coverage is measured constantly and attested almost never. ATT&CK is a coordinate system — what is missing is a statement someone can sign about what is actually covered.
Coverage, and what it should mean →Research
The Identity-pillar archive: OAuth attack chains, reproducible against FlawedToken. Kept because it is the proof behind the endpoint work, not despite it.
The Gap Nobody Talks About: From "OAuth Is Attackable" to "Here's the Proof"
The series intro: why practitioner proof matters, and the reframe from auth flows to the full Zero Trust model.
2026-05-22OAuth Authorization Code Interception: The Flow, the Seam, and What Your Logs Actually Show
Authorization code interception end-to-end: what the attack looks like, where the seam is, and what it produces in logs. Reproducible against FlawedToken.
2026-07-11Redirect URI Manipulation: Stealing the Authorization Code at the Door
The redirect_uri is the load-bearing control in the OAuth authorization code flow, and it fails quietly. A red-team walkthrough.
2026-05-29The Local Lab Blueprint: Building an Isolated, Scriptable Interception Lab
A reproducible, containerized interception lab for auth-flow research — mitmproxy, Docker, and browser session containerization.
Endpoint — the current arc
The current arc: the runtime, the worker process, and the detection gap around them. Published as each one is finished, not before.
| # | Working title | The angle | Status |
|---|---|---|---|
| 1 | The runtime is the host | A web-facing exploit is an endpoint problem: the interpreter, the worker process that executes it, and the EDR that never classed it as a host event. | in progress |
| 2 | The detection that should have fired | What endpoint detection should have caught and cannot reliably: the quiet HTTP 200, the “in Unknown on line 0” tell, the ASLR and error-display gap. | planned |
| 3 | From token to foothold | The bridge post: how a credential or identity flaw becomes an endpoint foothold — auth is the door, the endpoint is the room. | planned |
| 4 | What coverage should mean | The architect's view: detection coverage is measured but rarely attested. ATT&CK is the coordinate system; the signed statement on top of it is missing. | planned |
Where I work, one surface at a time
CISA's Zero Trust Maturity Model frames security across five pillars. This site builds the practitioner view of each — endpoint first, because that is where the exploit finishes.
Endpoint
Runtime exposure, worker processes, agent and EDR coverage, host telemetry. What executes the attack, and what should have seen it execute.
Endpoint research →Identity
OAuth, OIDC, SAML, session abuse, MFA bypass — the attack chains that got this site started, and the reason the endpoint question follows.
Identity research →Applications
API payloads, support tickets, RAG pipelines, LLM prompts. The new redaction frontier.
Applications →Data
DLP, masking, tokenization, verified-clean redaction. The crown jewel and the final wall.
Data →Visibility & Automation
SIEM pipelines, SOAR playbooks, policy-as-code. Where detection rules become systemic.
Visibility & Automation →The redaction thread
Redaction isn't a Data-pillar problem, and it isn't only a document problem. Endpoint telemetry carries identity artifacts, secrets in command lines, and customer data in process memory. This site documents the whole surface, and ShroudCloud builds the detection engine for it.
| Pillar | Where PII hides | Redaction play |
|---|---|---|
| Endpoint | Process command lines, agent telemetry, crash dumps | Scrub before telemetry leaves the host |
| Identity | Auth logs, SSO audit, session records | JWTs, OAuth codes, bearer tokens |
| Networks | DNS, NetFlow, mail gateway logs | Identifiers stripped from metadata |
| Applications | API payloads, tickets, LLM prompts | Shroud before the model sees it |
| Data | Documents, databases, DLP pipelines | Verified-clean export with audit trail |
Working on the endpoint problem?
I'm open to endpoint security architecture roles, and to research collaboration. If you are trying to explain what is actually covered on your endpoints — or what keeps executing on them — that is the conversation I want to have.