Feed
Practical guides for CTOs, security architects and senior engineers: how secure systems are structured, how to review the one you already run, and where AI helps and where it doesn't.
Start here
Foundations · 5 min read
The decisions that make a new system defensible before its first incident: five facts to write down, a skeleton with its boundaries drawn in, and defaults that hold without heroics.
Boundaries · 4 min read
What a trust boundary really is, the six kinds every system has, how to find them by following requests, and the control each crossing needs.
Practice · 4 min read
An honest account of AI in security architecture review: what it does well (reading everything, connecting evidence, drafting hypotheses), what it cannot do, and how to tell the difference in any tool.
12 guides
Design decisions that make a system defensible before the first incident.
Foundations · 4 min read
Security decisions outlive the people who made them. A practical ADR template with security fields, a worked example, and how to keep decisions honest against the system you actually run.
Foundations · 5 min read
The decisions that make a new system defensible before its first incident: five facts to write down, a skeleton with its boundaries drawn in, and defaults that hold without heroics.
Foundations · 4 min read
Layered, modular monolith, hexagonal, microservices, event-driven or serverless: how to tell which one you really run, and where each style puts its trust boundaries.
Where trust changes, who can act, how data moves and how far a failure spreads.
Boundaries · 4 min read
Breaches rarely start in the primary database. They start in the copies: logs, exports, backups and vendors. How to classify data, trace one record through a system and put a control on every hop.
Boundaries · 4 min read
Every system has a blast radius; the only question is whether you chose it. Cells, bulkheads, shuffle sharding, circuit breakers and progressive delivery, and how to set a budget for them.
Boundaries · 4 min read
Attackers move through a system by chaining identities: a laptop key to a cloud role to a database. How to map those chains, spot the weak links and design them to break safely.
Boundaries · 4 min read
What a trust boundary really is, the six kinds every system has, how to find them by following requests, and the control each crossing needs.
The paths code and dependencies take from a laptop to production.
Delivery and supply chain · 4 min read
Whoever controls your pipeline controls production. How to separate building untrusted code from holding deploy power, replace stored secrets with federation, and make the artifact the unit of trust.
Delivery and supply chain · 4 min read
Dependencies, base images and CI actions run with your privileges but are written by other owners. How to control what enters, know what you shipped, prove how it was built, and be a good upstream.
Methods for reviewing a real system: threat models, findings and the role of AI.
Practice · 4 min read
A CVSS score describes a bug. Whether it matters depends on your architecture: is the code present, reachable, and holding privileges worth stealing? Four questions that turn an advisory into a decision.
Practice · 4 min read
An honest account of AI in security architecture review: what it does well (reading everything, connecting evidence, drafting hypotheses), what it cannot do, and how to tell the difference in any tool.
Practice · 4 min read
Threat models go stale because they mix what you know, what you suspect and what you decided. Keep the three apart and a model stays useful, testable and easy to update.
No guide matches these filters yet. Clear them, or try a broader word.
Recently published vulnerabilities, to read beside “From vulnerability to architectural impact”.
Generate the security rules your coding agents follow, as SKILL.md, AGENTS.md or editor rule files, for the use case and target you choose.
Every new guide, newest first, for your reader or the agents that watch for new material.
Veriom rebuilds a model of your components, relationships and trust boundaries from code, infrastructure as code, cloud and delivery evidence at every audit, and links each finding to the evidence behind it.