Pranava Adduri

💡 AI doesn’t just change how code is written – it changes expectations and outcomes. In the final section of Jellyfish’s AI Adoption Guide, we explore how expectations for engineering leaders are evolving as AI becomes embedded across the SDLC. Because the organizations pulling ahead are treating AI as a transformation, not a tooling upgrade. Inside, you’ll explore: - Why AI adoption is quickly becoming a leadership mandate, not an option - How to balance ambitious goals with realistic expectations - What cultural investments are required to sustain long-term gains - How data can be used to align executives and engineering teams The teams that win in the AI era won’t just have better tools – they’ll have leaders who know how to guide change. Download today: https://lnkd.in/dut_6WpQ

20

For the third consecutive year, the Red Team Association is proud to command the official BSides Seattle CTF. This year, we are deorbiting a bespoke collection of 11 unique services engineered specifically for this engagement. Whether you are a seasoned exploit developer or a burgeoning security researcher, our mission architecture offers a diverse spectrum of difficulty. This year’s operational theater is entirely space-themed, providing a cohesive narrative for those who find interest in the intersection of aerospace and offensive security. Beyond the Terminal: We are bringing the digital into the physical. Attendees can expect rigorous real-world challenges involving: - Physical Security: RFID and Badge Cloning. - Signals Intelligence: Bluetooth Low Energy (BLE) exploitation. - Information Gathering: Advanced OSINT objectives. In the coming days, we will be releasing technical briefings on specific services to help you prepare your toolkit. Prepare for liftoff. We’ll see you on the floor.

102

5 Comments

I love the way Ozgun puts it: Ubicloud is an open-source alternative to AWS, at a fraction of the cost How do they dare take on these cloud giants? Özgun shares the backgrounds of the founding team (Daniel and Umur) and what it really takes to go head to head with big tech   More videos from e2vc Summit!

64

1 Comment

BREAKING: “Careful. Very careful.” officially added to the enterprise security stack. “Transition entire database to MongoDB. Careful. Very careful.” That is the moment where the progress bar turns into a personality test 🤣 #AI accelerates delivery and compresses the distance between intent and production. In that compression, decision clarity becomes a core capability. A database migration is a strategic choice expressed through code. It shapes: • data models and integrity rules • access control and audit trails • resilience targets and recovery posture • vendor dependency and cost curves • regulatory assurance and evidence.. that's my playground 🛝 😍 Teams that move fast and stay steady run major changes as an authority protocol: • one named decision owner with a defined mandate • gated change paths with review and approval • rehearsed rollback and recovery objectives • compliance checkpoints tied to data classification • a concise decision record that supports continuity The meme lands because the warning feels like protection…. Structured authority carries the work. #AI #TechGovernance #Cybersecurity #DataManagement #DigitalTransformation #Leadership

23

Despite the many benefits of Data #CleanRooms they may turn participating parties into Data Brokers as per California’s DELETE Act if they happen to bring 3rd party data (no direct relationship) into the platform, triggering a registration and tech alignment requirement (and hefty fines if dates are missed). (Presentation by California Privacy Protection Agency and Ben Isaacson on the DELETE ACT and the new #DROP platform that integrates all data brokers for consumers to place a single request.) Privacy Law Section of the California Lawyers Association. #AdTech

57

5 Comments

While Wazuh built-in active response is a powerful feature, we felt we could make it fit even better within our SIEM stack. That’s why I’m excited to share a better way to work with Wazuh Active Response using Graylog and CoPilot. This isn’t just a workaround--it’s a whole new level of flexibility and automation for your security operations. In my latest video, I walk through how you can: * Use Graylog’s threat enrichment to identify high-risk events. * Trigger Wazuh Active Response externally via Copilot’s API integration. * Bypass the limitations of built-in response scripts and create custom responses for any scenario, even those beyond Wazuh’s original detection. This approach unlocks the full potential of Wazuh Active Response--letting you create tailored, powerful automations for incident response, whether the trigger comes from Wazuh, Graylog, or even external systems. https://lnkd.in/gKzZkYUq

105

2 Comments

A quick deck to help Moderne customers address the newly discovered RCE in Apache Parquet (🐞CVE-2025-30065). It's a remote code execution flaw in Apache Parquet ≤1.15.0 that can be exploited by providing a malicious file. I don't think this will often be demonstrably exploitable (at least if users can't directly provide such malicious files or cause them to be created). But save yourself the headache of explaining why it isn't exploitable, and maybe just fix it 🙂 . This is just another in a long line of examples of CWE-502.

48

NEXTGEN INFRA STARTUPS MUST PLAY OFFENSE Historically, software infrastructure / middleware startups have played DEFENSE well. They have built deep, defensible technology moats over a period of time. The founders have been deeply technical, have sold to other developers, and have been content to not have a strong public-facing brand. However, this playbook (and archetype) must change. Infra founders and startups must play OFFENSE and become more dynamic and front footed. Why? First, foundation models are adding more and more infastructural components and nibbling away at what was traditionally considered infrastructure. No company can now comfortably sit and own a part of the stack. It will inevitably erode. Second, end customers are deciding or opining on what infrastructure to use. Guess what? Customers of infra products are no longer just career engineers but ordinary people (including VCs!) Infrastructure now has a PLG motion. Having a customer-facing brand is no longer optional. Finally, it’s possible (or even probable) that your company might need to fundamentally change its business model, and not be an infrastructure company any more. And in this crucible moment, you need to have the muscle and the ability to seize the opportunity and go for it. Consider OpenAI launching ChatGPT or Vercel launching v0. They could never have managed it with a legacy infrastructure mindset. Check out Groq’s homepage - it looks more like a vibecoding startup than a chip company. To summarize, infrastructure startups need to evolve. They must start thinking about the end customers, become much more public-facing with their brand, and develop the muscle to build customer-facing (not just developer facing) products. The archetype of infrastructure founders is changing. They cannot just be technical. That’s tablestakes. They must build a deep understanding of their customers’ customers, be superb at product development, marketing, storytelling and brand building, and be ready to move up the stack at any time. In other words, they must be able to play OFFENSE. That’s what greatness means in infra companies today.

146

8 Comments

The night before this segment I was building an AWS deploy skill with LangChain's new deep agents. And the division of labor tells you everything about where this stack is headed. Deep agents handles all the different local calls needed to orchestrate the deploy. Arcade.dev handles the connection. It authenticates to AWS, manages the credentials, ensures the agent has the right permissions to actually touch that infrastructure. You need both. A framework without auth is a demo. Auth without orchestration is just plumbing. The "how quickly you can get something up in the cloud" part only works when these layers aren't fighting each other. When you're not hand-rolling OAuth for every integration or building custom auth middleware into your agent loop.

124

2 Comments

Terragrunt is a band-aid for a wound Terraform never treated. Terragrunt didn't get popular because teams were clamoring for yet another wrapper. It became popular because Terraform's state model backs you into a corner, where a single file pretends it can represent a scalable system while forcing everyone into serialized execution that falls apart the moment real infrastructure shows up. Teams begin with one state file because that's easy to reason about. Your infrastructure grows and you split the file. The moment you do, the orchestration problem appears, and Terraform has no concept of it. Terragrunt steps in and stitches together the structure Terraform never provided. Directories turn into dependency boundaries, separate Terraform processes become the illusion of parallelism, and the wrapper quietly takes over responsibility for ordering, safety, and isolation. Terragrunt has been a meaningful contribution to the community, but at some point we have to name the real issue. Fix the state and the whole substrate stops fighting you. #terraform

74

14 Comments

Incident response is one of my favorite use-cases for demonstrating the value of building on top of the Claude Agent SDK. I had so much fun working with the talented Ben Lehrburger on a new cookbook for the SRE Incident Response Agent, which walks through building an SRE agent on the Agent SDK! A few things we cover in our cookbook: - How to give agents safe write access to infrastructure by scoping MCP tools with restricted directories, command allowlists, and validation hooks - Why clear tool descriptions drive autonomous agent behavior more effectively than elaborate prompts - How agents can synthesize across production signals like metrics, logs, alerts, and configuration to build a coherent diagnosis that no single data source could reveal on its own - How to structure human-in-the-loop workflows that separate investigation from remediation, so you control when agents act autonomously Check it out at https://lnkd.in/gdZTV85s!

235

9 Comments

Been watching the rise of AI code review tools with some concern... they get deep repo access, but what happens if they’re exploited? Well…Kudelski Security just showed us. 👇 A simple PR → remote code execution on CodeRabbit’s infra → read/write on 1M+ repos. Private code, secrets, DB access, all exposed. Big shoutout to the Kudelski team for this research. And remember, if your “review bot” can run code, assume attackers can make it run theirs.

25

2 Comments

A new release of Rotonda, NLnet Labs' composable, programmable #BGP engine in #rustlang, is now available. Version 0.4.0 'Bold and Undaunting Youth' features and #RPKI RTR component, as well as Route Origin Validation on incoming routes. https://lnkd.in/eT3V8Zk3

17