https://thesecguy.com/ Short, practical videos on cloud and AI security: the real mistakes attackers exploit in AWS, Azure, GCP, OCI and AI systems, and exactly how to fix them. en https://thesecguy.com/notes/5-aws-settings-attackers-hope-you-skipped/https://thesecguy.com/notes/5-aws-settings-attackers-hope-you-skipped/Thu, 22 Oct 2026 00:00:00 GMTFive account-level AWS settings close the doors attackers find open most often: S3 Block Public Access at the account level, IMDSv2 as the default for new EC2 instances, MFA on the root user, one CloudTrail trail across all Regions, and IAM Access Analyzer. Each takes about two minutes, and you do them once per account. https://thesecguy.com/notes/ai-security-certifications-2026/https://thesecguy.com/notes/ai-security-certifications-2026/Thu, 22 Oct 2026 00:00:00 GMTAs of October 2026 there are only a few real AI security certifications. ISACA AAISM is for managers who already hold CISM or CISSP. CompTIA SecAI+ (launched February 2026) and GIAC GAIPS are for hands-on practitioners, IAPP AIGP is for AI governance, and OffSec OSAI is a practical exam for red teamers. ISC2's AI security certification is still in development, so pick by the job you do. https://thesecguy.com/notes/how-to-become-an-ai-security-engineer/https://thesecguy.com/notes/how-to-become-an-ai-security-engineer/Thu, 22 Oct 2026 00:00:00 GMTStart with normal security and one cloud, because most AI security work is still identity, data and network control. Then learn how LLM apps, RAG and agents are wired, practise the attacks in the OWASP Top 10 for LLM Applications, and learn your cloud's AI guardrails. Finish with detection, governance and three small public projects. A certificate helps after that, not before. https://thesecguy.com/notes/leaked-aws-key-first-5-minutes/https://thesecguy.com/notes/leaked-aws-key-first-5-minutes/Thu, 22 Oct 2026 00:00:00 GMTAttackers can find and use an AWS access key pushed to a public GitHub repo within about five minutes; in Unit 42's EleKtra-Leak research they used exposed keys to launch crypto-mining instances. Deleting the commit is not enough: deactivate the key at once, check CloudTrail for what it did, and move to short-lived credentials. https://thesecguy.com/notes/prompt-injection-6-real-ai-agent-hijacks/https://thesecguy.com/notes/prompt-injection-6-real-ai-agent-hijacks/Thu, 22 Oct 2026 00:00:00 GMTAn AI agent can't reliably tell data from instructions, so anything it reads (a log, a form, a PDF, a GitHub issue, an email) can carry a command it then runs with your access. That is indirect prompt injection. Treat every tool result as untrusted, require human approval for risky actions, give agents short-lived least-privilege tokens, block data exfiltration paths, and audit every MCP server and extension. https://thesecguy.com/videos/ai-agent-hijacks/https://thesecguy.com/videos/ai-agent-hijacks/Thu, 22 Oct 2026 00:00:00 GMTSix real cases where an error log, a contact form, a PDF, a GitHub issue, an email and a browser extension hijacked AI agents, and the five fixes that stop all of them. https://thesecguy.com/notes/owasp-llm-top-10-2026-vs-2025/https://thesecguy.com/notes/owasp-llm-top-10-2026-vs-2025/Wed, 21 Oct 2026 00:00:00 GMTOWASP published the 2026 Top 10 for LLM Applications in August 2026 and reordered the list, so the IDs changed meaning: LLM06 was Excessive Agency in 2025 and is Unbounded Consumption in 2026. Always write the year with the ID (LLM06:2026), and re-map any risk register, policy or scanner rule that uses the old numbers. https://thesecguy.com/videos/s3-private-bucket-leaks/https://thesecguy.com/videos/s3-private-bucket-leaks/Sun, 18 Oct 2026 00:00:00 GMTSix real ways data leaks from S3 buckets that look locked down, from public objects to CloudFront and leaked keys, and how to close each one. https://thesecguy.com/videos/trailer/https://thesecguy.com/videos/trailer/Sun, 18 Oct 2026 00:00:00 GMTThe trailer for Cloud & AI Security in 5 Minutes: what's coming every week across AWS, Azure, GCP, OCI and AI agents, and the free Cloud & AI Security Quick Check.