Writing
Divan-e-Cyber: as with cybersecurity, interpretation and attribution count.
Browse by topic: Detection & SOC · AI security · Microsoft Security · Exposure management · Community & personal
-
Outages Are Cover for Social Engineers. Your Logs Will Not Show It.
Read more: Outages Are Cover for Social Engineers. Your Logs Will Not Show It.An outage hands a caller the perfect pretext for a help desk reset. Your logs will record the reset, but not the call that earned it. In my own check of an outage window, the call transcripts are what let us move two malicious resets to incident response.
-
Design Conditional Access like a non-Newtonian fluid
Read more: Design Conditional Access like a non-Newtonian fluidConditional Access policy plans give you a better place to decide how access behaves under pressure. Here is how to design for low, fast and sustained stress, and where the model breaks.
-
Your agents don’t have badges. Your SOC pays for it.
Read more: Your agents don’t have badges. Your SOC pays for it.You had to go through HR, a photo and an approval to get your badge. Your AI agents got nothing. No badge, no problem. Until your SOC has to investigate one. I gave this talk at Cloud Identity Summit in Frankfurt today, as the SOC person in a room full of identity people. My point…
-
Lessons from the penny
Read more: Lessons from the pennyMost Sentinel cost cuts fail for the same reason: nobody can show which records a detection or an investigation still depends on. Without that evidence, you either keep paying for everything or cut and hope. This post, adapted from my BSides NYC talk October 17th 2026, lays out a third path: use AI, see the…
-
These are the highlights of my talk at CDC Germany 2026 in Hanau on October 1: “Deploying an AI Security Risk Framework + Continuous Monitoring.”
Read more: These are the highlights of my talk at CDC Germany 2026 in Hanau on October 1: “Deploying an AI Security Risk Framework + Continuous Monitoring.”Most of what the industry calls agentic security risk is exposure management, identity hygiene, and telemetry you already know how to run. What’s missing is not theory. It’s blueprints that someone can build from. I’ve been writing them, and more of us should. The board and the SOC are describing the same risk in different…
-
Two findings from Anthropic’s multiagent research are solvable. One needs our help.
Read more: Two findings from Anthropic’s multiagent research are solvable. One needs our help.Anthropic gave three AI agents the same codebase and three different migration targets. None knew the others existed. All three assumed sabotage. All three escalated. Agents disabled each other’s system accounts and shipped malicious code disguised as belonging to another agent. I proposed a decision record schema in an earlier post: identity, authority, judgment, lifecycle.…
-
Microsoft Solved Four Governance Problems. A Fifth One Is the Reason to Pay Attention.
Read more: Microsoft Solved Four Governance Problems. A Fifth One Is the Reason to Pay Attention.Project Perception is in public preview now. Red, blue, and green agents coordinating inside Defender, a shared security context instead of siloed telemetry, a harness routing work across models. Microsoft built the plumbing agentic security needs, and most of it is genuinely there from Microsoft. Governance for a system like this rests on five principles:…
-
6 Tests That Matter When You Deploy Project Perception
Read more: 6 Tests That Matter When You Deploy Project PerceptionTwo months ago, in April, Aleš Holeček announced Microsoft was building a multi-model scanning harness. The team that built it came from Team Atlanta, which won the $29.5 million DARPA AI Cyber Challenge by building an autonomous system that found and patched real bugs in complex open-source code. MDASH proved the concept. In May, they…
-
The Backup Model Isn’t the Backup Plan
Read more: The Backup Model Isn’t the Backup PlanHugging Face got breached in July 2026 by an autonomous AI agent that logged over 17,000 actions before anyone caught it. That story alone is worth your attention. But the detail that matters for your SOC isn’t the breach. It’s what happened when Hugging Face tried to investigate it. Their team turned to commercial frontier…
-
Your Detection Rules Are Artifacts. Your Tuning Decisions Are Too.
Read more: Your Detection Rules Are Artifacts. Your Tuning Decisions Are Too.The point up front: Every detection is actually three artifacts, not one. The rule logic, the tuning decisions, and the operational context. Most SOC teams document only the first. When the other two live in someone’s head, your institutional memory has a countdown timer on it. The fix is a single, version-controlled config artifact per…
🔐 Ghazal: “All Access Is Conditional”
(a modern security poem in ghazal form)
In this realm of cloud and claim, all access is conditional
The lover may knock, but still — permission is provisional
—
The gate is silent, the ID speaks, its posture holds the key
From signal comes salvation — detection is intuitional
—
Trust no device, no sign-in time, unless the risk aligns
The dance of context and control is wholly intuitional
—
Her token glowed, yet prompts appeared — a second factor asked
The veil may lift, but only when the bond is traditional
—
No open ports, no phantom guests, no silent lateral flow
My realm is built on principle, protection constitutional
—
From Persia’s gardens to Azure clouds, the guardians still remain
Their watchful eyes in every log — the shield is unadditional
—
And Mona writes, like Hafez would, of XDR and fate
To love the user is to test — the trust must be conditional*
Poetry inspired by a cybersecurity mindset
Exploring the intersection of creativity and security through poetry. Mona reflects on thoughts and lessons that shape her approach.
© 2026 Mona Ghadiri. All content, including text, images, and original poetry, is the intellectual property of Mona Ghadiri unless otherwise noted. Unauthorized use or reproduction is prohibited.
