The Patch Landed. The Keys Were Already Copied.
INC ransomware stole MFA seeds from SonicWall VPN gear before the fix shipped. Patching closed the door — it didn't change the locks on what's inside.
read the essay →issue · biweekly · est. 2026
Defending what moves inside the perimeter.
Field notes on lateral security, micro-segmentation, east-west detection, and application delivery — covering the products shaping how we defend and connect internal networks. Written for the security and network engineers actually configuring the distributed firewalls and load balancers.
new writing on the 1st & 15th of every month
the latest
also in the archive
-
17,000 Actions, One Weekend, Zero Humans
Hugging Face's breach disclosure confirms an intrusion run end-to-end by an autonomous AI agent. The lateral movement pattern is familiar — the pace isn't, and that changes what segmentation has to do.
-
What Actually Changes About vDefend Licensing in 9.1
The 25-character license key you've been using since NSX won't work on 9.1. Here's what you need in place before you upgrade.
-
Before the Patch Window Opens: Segmenting Your Backup Infrastructure
Any domain account can RCE your Veeam backup server right now. The Distributed Firewall is how you limit the blast radius while you wait for the patch.
-
Avi Load Balancer 32.1.1: VCF 9.1, MCP Traffic, and the Licensing Shift
Avi 32.1.1 lands native VCF 9.1 integration, MCP load balancing for AI agent workloads, and the same licensing model change shipping in SSP 5.1.2. Here's what it means in practice.