Where the exploit lands, and the pillars around it
CISA's Zero Trust Maturity Model frames security across five core technology pillars — Identity, Devices, Networks, Applications, and Data — with Visibility and Automation as cross-cutting capabilities. This site started in the Identity pillar and has moved its centre of gravity to the one where exploitation finishes: the endpoint. One thread runs through all of them:redaction — not a Data-pillar afterthought, but the discipline that keeps sensitive data from leaking out of every pillar at once.
1. Endpoint — where the exploit lands
Endpoint in the CISA model means device identity, posture, and telemetry. In practice it means the thing that executes the attack: the runtime, the worker process, the privileges it inherits, and the agent that was supposed to see it happen. This is the pillar I work in, and the one where the research is heading — seethe endpoint lens.
The redaction angle: endpoint telemetry carries command lines, process arguments, file paths, and crash dumps straight into a data lake. Those are among the richest sources of secrets and personal data an organisation produces, and they are almost never scrubbed at the point of collection.
2. Identity — where this site began
Identity is where this site earned its credibility. OAuth 2.0, OIDC, SAML, MFA bypass, session abuse — the attack chains that prove identity is the new perimeter. The full research archive lives in the blog, reproduced against FlawedToken. It stays, as chapter one of the endpoint story: identity flaws are what put someone inside.
The redaction angle: identity systems are PII factories. Every auth event writes logs full of JWTs, OAuth codes, bearer tokens, and session cookies. Those artifacts are exactly what redaction engines must catch — and most stop at names and SSNs.
3. Networks
Segmentation, micro-perimeters, and encrypted traffic — but also DNS logs, NetFlow, and email gateway records that are quietly full of personal data.
The redaction angle: network metadata is identity data. DNS queries and mail flow logs need the same masking discipline as any other sensitive dataset.
4. Applications
Workload identity, API security, and the exploding surface of AI-enabled applications. Every API call is a potential PII exfil channel.
The redaction angle: this is the new frontier. RAG pipelines, support tickets, and LLM prompts carry customer data straight into third-party models. Redaction before the model — with reversible placeholders — is the discipline that keeps AI compliant.
5. Data
The crown jewel. DLP, classification, masking, tokenization, and verified-clean document redaction. Every other pillar exists to protect this one.
The redaction angle: where redaction becomes a product. Documents with audit trails, fail-closed verification, and zero retention by design. This is the Data pillar's answer to the question every pillar asks: what do we do with the sensitive data we touch?
Cross-cutting: Visibility & Automation
The two capabilities that make the pillars coherent. Visibility means the analytics pipeline sees everything; Automation means the response is systematic. Both have the same redaction requirement: the data that flows into SIEMs and SOAR playbooks must be scrubbed before it becomes a liability.
Where this is going
The Identity archive is complete and stays. The endpoint arc is in progress — the runtime, the detection gap around it, and the question of what detection coverage should be able to prove — with ShroudCloud as the detection engine that operationalizes the redaction thread.