AI security
AI Agent: Who Approved That?
An autonomous assistant requests production access. Efficiency is real. So is the blast radius.
7–9 min · 5 decisionsTake command →
FEATURED INCIDENT · OCTOBER 2026
PHP2Shell. 72 hours to decide.
A critical PHP vulnerability. An incomplete inventory. A CEO who wants zero downtime. The better decision still has a price.
THE BIG RED BUTTON · CONTROL ROOMSIMULATED TELEMETRY
Enable emergency PHP exposure controls
Toggle the control. Watch what disappears, what remains, and what costs the business.
SECURITY ON · CONTROL ACTIVE
Interim restrictions reduce some attack paths while patching proceeds.
Suspicious execution alerts
37Investigate: alerts are not confirmed compromise
Blocked requests under review
12Some may be legitimate customer traffic
Known public assets covered
96%Remaining inventory is unverified
Planned patch maintenance
4hDowntime and regression testing still required
Cost of keeping this control ON
WAF and restrictions are not equivalent to patching; verify the fixed runtime.
Illustrative numbers only. Alerts are not confirmed incidents. Green means a control is active, not that your organization is safe.
THE DECISION LAB
—recorded site visits
—recorded scenario completions
5interactive scenarios
Counts reflect recorded sessions and completions only when the live counter is connected; never fabricated.
MAKE THE CALL
Five incident rooms. No perfect answers.
Choose a scenario, switch a control and experience the consequences.
Identity and access
The Executive Exception: MFA Under Pressure
The CEO wants speed. Security wants MFA. You own the trade-off.
6 minutes · 4 decisionsTake command →
Cloud security
Bad Config Museum: The Public Bucket
A storage bucket was exposed to the internet. Fixing visibility is only the beginning.
7–9 min · 5 decisionsTake command →
Incident response
CISO Nightmare: The Ransomware Call
Systems are encrypted. Recovery is uncertain. The board needs a plan before the next meeting.
7–9 min · 5 decisionsTake command →
THE SECURITYOFF PRINCIPLE
Security ON is not the end of the story.
Controls reduce exposure. They also introduce downtime, costs, friction, exceptions and governance obligations. Our scenarios make both sides visible.