Tom Stacy, CISSP®

I'm an endpoint security architect. I've spent my career on the layers attackers actually have to cross — endpoint, identity, and the data pipeline in between — at IBM Security, CrowdStrike, and Trend Micro. This site is where the proof for what I claim publicly gets built, documented, and shared.

The arc

I secured the perimeter. Then I secured the data pipeline. Now I work where attackers actually land: the endpoint — the runtime, the worker process, the host that executes the exploit and the detection stack that was supposed to notice.

The research started in the Identity pillar — OAuth attack chains, reproducible labs, and what the attacks look like from the defender's side. That archive is complete and it stays: an auth flow flaw is what puts someone inside, and the endpoint is where they go next. It is chapter one, not a dead end.

One thread runs through all of it: redaction. The same discipline that catches a stolen authorization code stops a customer's name from leaking out of endpoint telemetry or into an LLM prompt.

The tools

• FlawedToken — the open-source vulnerable OAuth lab. Every misconfiguration deliberate, documented, and toggleable. Chapter one's lab.
• ShroudCloud — the detection engine for PII and secrets across documents, logs, and AI pipelines.

How I work

Everything here is practitioner-tested: reproduced against a purpose-built lab, with the conditions, the logs, and the fix written down. No theory without proof. That's the standard this site holds, and it's the standard ShroudCloud is built to.

What I'm looking for

Endpoint security architecture roles, and research collaboration with people trying to answer the awkward questions — what is executing on your endpoints, and what are you able to say about it with a straight face?