Mike Sosa's notes on cloud security, AI security, and leadership, from the labs and projects he builds. Written plainly.https://mikedsosa.com/en-ushttps://mikedsosa.com/blog/four-labs-on-one-attack-chain/https://mikedsosa.com/blog/four-labs-on-one-attack-chain/How four public labs fit one common cloud-identity pattern on a single map: phishing that gets through, a compromised Entra account, the order of containment, identity hardening that shrinks the next mess, and a parallel path where an AI agent is steered by untrusted content.Mon, 09 Nov 2026 00:00:00 GMTCloud SecurityAI Securityhttps://mikedsosa.com/blog/order-of-operations/https://mikedsosa.com/blog/order-of-operations/Notes from writing an incident response runbook for a compromised Microsoft Entra ID account: why the order of containment steps matters, what attackers leave behind, and the decisions worth making before the incident instead of during it.Mon, 02 Nov 2026 00:00:00 GMTCloud SecurityLeadershiphttps://mikedsosa.com/blog/report-only-first/https://mikedsosa.com/blog/report-only-first/Notes from building an Entra ID hardening lab in Terraform: why identity is where I'd start, why every Conditional Access policy should start in report-only mode, and why 'it validates' isn't the same as 'it works.'Wed, 28 Oct 2026 00:00:00 GMTCloud SecurityLeadershiphttps://mikedsosa.com/blog/a-floor-not-a-ceiling/https://mikedsosa.com/blog/a-floor-not-a-ceiling/What my Georgia Tech capstone taught me about why one-size-fits-all cyber rules fail small water utilities, and why a tiered approach that starts with a hard floor works better.Sun, 25 Oct 2026 00:00:00 GMTCritical InfrastructureLeadership