iac
2 posts · all writing
A misconfiguration has no CVSS, which is why nobody fixes it
A privileged pod and a public bucket have no CVE and no CVSS, so every IaC tool invents a severity and the breach sorts below an unreachable dependency.
You don't need twelve scanners, just the four that apply
Teams adopt security tooling as nothing or everything at once, and both fail because nobody decided which controls their software actually needs.