Blog

Popular Topics

Blog Post

Trust but Sandbox

Coding agents can now do (almost) everything. They read and write every file you have access to, they run arbitrary commands, talk over the network, read your environment variables, and drive your browser with all your cookies. In the spirit of an agentic workflow, where we let agents work as autonomously as possible, that is actually the point, because it is exactly what makes them useful. Even so, we should find a way to gain more control over what happens in there.

Blog Post

Stop Using Bearer Tokens Like House Keys

You’ve built an API. You protected it with OAuth 2.0. You’re using JWTs. You feel secure. You’re not.

Blog Post

Nebu: Self-made sovereignty

How I’m building an enterprise chat server with agentic development that simply doesn’t exist.

Blog Post

Neuland reloaded

When Angela Merkel said in 2013 that the internet is ‘Neuland’ (uncharted territory) for all of us, the amusement online was considerable. Viewed from some temporal and substantive distance, one can now recognize a perspective from which she was indeed correct.

Blog Post

Let’s Not Normalize Insecure AI Assistants

AI assistants like OpenClaw promise convenience, autonomy, and increasingly personalized help. But beneath that promise lies an architecture that quietly combines private data, internet access, and exposure to untrusted content—the lethal trifecta of security risk. Sandboxing and physical isolation help, but they don’t address the core problem. As we add more capabilities, the potential blast radius only grows. This post is a case for slowing down, questioning defaults, and refusing to normalize insecure architectures.

Blog Post

Die persönliche KI ist schon da

Wir sind vermutlich noch nicht darauf vorbereitet

Blog Post

I sandboxed my coding agents. You should too.

LLM coding agents are extremely powerful because they can run programs on our computers using our permissions. However, this same power also makes us very vulnerable. It only takes one mistake or one prompt injection to compromise the whole system.

Blog Post

Managing Geopolitical Risks with Enterprise Architecture

IT leaders in Europe increasingly face questions about whether geopolitical developments – such as data protection disputes or trade conflicts between the EU and the US – threaten the viability of US cloud services. The risks range from price increases and legal uncertainties to potential usage restrictions. CIOs must not only ensure functional IT operations but also proactively assess external risks. This article demonstrates how enterprise architecture methods can help identify risks early and develop viable alternatives.

Blog Post

A Governance Framework for Digital Sovereignty
Blog Post

The Path to Heterogeneous Cloud Platforms

Digital transformation brings both challenges and opportunities for businesses. To create future-proof and flexible IT infrastructures, more and more companies are adopting multi-cloud or hybrid cloud strategies. This isn’t just about cost reduction, but also about aligning innovative services from different providers with regulatory requirements - particularly in the area of data protection. This article shows how targeted integration strategies can help you leverage the benefits of multi-cloud to optimize your existing infrastructure, reduce technical dependencies, and ensure long-term business success.

Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Practical Considerations & Recommendations

Turning principles and patterns into practice — just as promised.

Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Decision Dimensions for Authorization Patterns
Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Authorization Patterns

Authorization patterns explain how distributed systems organize their access control — where and how decisions happen, where policies live — and influence, in turn, how identities and related attributes travel between components.

Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Identity Propagation Patterns

Without trustworthy identity propagation, even strong initial authentication can be undermined — weakening trust boundaries and ultimately impairing the system’s ability to make reliable authorization decisions.

Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Authentication Patterns
Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Core Concepts

In part two of my series, I begin the journey to rethink the OWASP Microservice Security Cheat Sheet. This post focuses on core concepts, laying the groundwork for practical, real-world microservice security.

Blog Post

What’s Wrong with the Current OWASP Microservice Security Cheat Sheet?

Modern microservice architectures require evolving security practices. Yet popular resources like the OWASP Microservice Security Cheat Sheet are starting to show their age and need a fresh look.

Blog Post

Asset Administration Shell und Model Context Protocol

Freund oder Feind?

Blog Post

Kubernetes sicher und transparent – Erste Schritte mit Cilium

Cilium bringt Observability-, Security- und Netzwerkfeatures für Kubernetes – dank eBPF ganz ohne den eigentlichen Anwendungscode zu ändern. In dieser Artikelreihe lernen wir, wie wir ein lokales Cilium-Setup aufsetzen, wie Cilium funktioniert und in weiteren Teilen auch, eigene Netzwerkregeln durchzusetzen und sie in Echtzeit zu überwachen. Starte deinen lokalen Cluster und werde zum Kubernetes-Jedi-Meister - oder folge der dunklen Seite der Macht.

Blog Post

Kubernetes sicher und transparent – Erste Schritte mit Cilium

Cilium bringt Observability-, Security- und Netzwerkfeatures für Kubernetes – dank eBPF ganz ohne den eigentlichen Anwendungscode zu ändern. In dieser Artikelreihe lernen wir, wie wir ein lokales Cilium-Setup aufsetzen, wie Cilium funktioniert und in weiteren Teilen auch, eigene Netzwerkregeln durchzusetzen und sie in Echtzeit zu überwachen. Starte deinen lokalen Cluster und werde zum Kubernetes-Jedi-Meister - oder folge der dunklen Seite der Macht.

Blog Post

Kubernetes sicher und transparent – Erste Schritte mit Cilium

Teil 2: Zerstört den Todesstern!

Blog Post

Beyond the hype: An engineer’s journey into ReBAC and AI with the Model Context Protocol

In this article, I share my experiences on my journey into the AI world. During this journey, we’ll build our own Model Context Protocol (MCP) Server using C Sharp, learn about access management with relationship based access control (ReBAC) on the way, and in the end I’ll provide my thoughts on the current state of AI and MCP, focusing on security and UX.

Blog Post

Bringt eure Schafe ins Trockene: Tipps für politische Risikovorsorge

Eines vorweg: Keine Panik! Das ist aktuell wichtiger als sonst. Leider hat sich die Welt in den letzten Monaten drastisch verändert, sodass nun ein neues Risiko aufgetaucht ist: Die US-basierten Cloud-Dienste, die uns viel ermöglichen, die den Betrieb von Anwendungen so vereinfacht haben und viele Innovationen ermöglichen, könnten auf einmal gegen uns verwendet werden. Sei es politischer Machtmissbrauch oder eskalierender Drang nach Reichtum. Dies ist ein komplett neues Risiko, das auf uns alle in Europa zukommt.

Blog Post

Digitale Souveränität

Strategischer Imperativ für Europas Unternehmen

Blog Post

Social Engineering ist durchgespielt

Der Angriff auf die Kompressionsbibliothek xz hat gezeigt, wie fragil die digitale Infrastruktur ist, die die moderne Welt am Laufen hält. In dieser Kolumne soll betrachtet werden, wie die sozialen Mechanismen Vertrauen und Misstrauen in diesem Zusammenhang wirken.