I SUMMARIZED THIS EXCHANGE
๐ฟ๐ฆ: We are against illegals in SA
๐ณ๐ฌ: But I am not illegal
๐ฟ๐ฆ: We donโt want foreigners who take our jobs
๐ณ๐ฌ: I created jobs for South Africans
๐ฟ๐ฆ: We just want you to leave our country even if you created jobs & are documented
๐ณ๐ฌ: No problem, pay what I invested, I will leave
๐ฟ๐ฆ: We will see you on June 30th
NOTE: That business might get destroyed & the owner killed if this issue is not handled swiftly.
๐ณ๐ณ% ๐ผ๐ณ ๐ผ๐ฟ๐ด๐ฎ๐ป๐ถ๐๐ฎ๐๐ถ๐ผ๐ป๐ ๐ฎ๐ฟ๐ฒ ๐ฟ๐๐ป๐ป๐ถ๐ป๐ด ๐๐ ๐ถ๐ป ๐๐ต๐ฒ๐ถ๐ฟ ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐๐๐ฎ๐ฐ๐ธ.
๐ข๐ป๐น๐ ๐ฏ๐ณ% ๐ต๐ฎ๐๐ฒ ๐ฎ ๐ณ๐ผ๐ฟ๐บ๐ฎ๐น ๐๐ ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐ฝ๐ผ๐น๐ถ๐ฐ๐.
That's from the Cloud Security Alliance's State of AI Cybersecurity 2026 report, which surveyed 1,500+ security leaders.
Think about what that gap means operationally.
Your team uses AI to detect threats, triage alerts, and automate responses. But there's no documented policy governing how those tools are authorized, audited, or constrained.
When a SOC 2 auditor asks, "How do you govern AI in your security operations?" Most teams don't have an answer.
That's not a compliance checkbox problem. It's a risk posture problem.
Here's a high-level of what AI governance in a security program actually requires:
- Authorization scope per AI tool
- Audit trail requirements
- Escalation thresholds
- Vendor risk classification
Your AI tools are third-party dependencies
They need the same scrutiny as any other vendor in your stack
AI tools without governance boundaries aren't just a compliance gap. They're an unmonitored attack surface.
What's the biggest governance gap you've seen in AI security deployments?
If you're approaching a SOC 2 audit with AI in your stack, this conversation needs to happen before the auditor asks. DM me or book a discovery call: https://t.co/sflOWZUm4e
๐ฐ Source: CSA State of AI Cybersecurity 2026 https://t.co/m6MWjpZ0ZV
๐๐ป ๐๐ถ๐ ๐บ๐ถ๐ป๐๐๐ฒ๐, ๐ญ๐ฒ๐ฌ+ ๐ฝ๐ฎ๐ฐ๐ธ๐ฎ๐ด๐ฒ๐ ๐๐ฒ๐ฟ๐ฒ ๐ฐ๐ผ๐บ๐ฝ๐ฟ๐ผ๐บ๐ถ๐๐ฒ๐ฑ. That's how long "Mini Shai-Hulud" needed to move through the TanStack ecosystem.
It stole CI/CD credentials by hijacking legitimate pipeline workflows. It reached Mistral AI, UiPath, and OpenSearch. Two OpenAI employee devices were infected.
This isn't a fairytale. It happened inside production pipelines at companies that thought their dependencies were clean.
Here's what your team should be doing right now:
โฏ๏ธ ๐๐๐ฑ๐ถ๐ ๐๐ผ๐๐ฟ ๐น๐ผ๐ฐ๐ธ๐ณ๐ถ๐น๐ฒ๐
ย ย โข Check for @tanstack/* and related packages; you may use a code repository filter for a quick check
ย ย โข If a version was pinned before the patch, assume exposure
โฏ๏ธ ๐ฃ๐ถ๐ป ๐๐ผ๐๐ฟ ๐ฑ๐ฒ๐ฝ๐ฒ๐ป๐ฑ๐ฒ๐ป๐ฐ๐ ๐๐ฒ๐ฟ๐๐ถ๐ผ๐ป๐ ๐ฒ๐ ๐ฝ๐น๐ถ๐ฐ๐ถ๐๐น๐, ๐๐ต๐ผ๐๐ด๐ต ๐ฐ๐ผ๐ป๐๐ฒ๐ ๐๐๐ฎ๐น
ย ย โข Floating versions let attackers ride legitimate update channels and cadence
ย ย โข Pinning forces a human decision before anything changes
โฏ๏ธ ๐๐บ๐ฝ๐น๐ฒ๐บ๐ฒ๐ป๐ ๐ฆ๐๐ข๐ ๐ด๐ฒ๐ป๐ฒ๐ฟ๐ฎ๐๐ถ๐ผ๐ป ๐ผ๐ฟ ๐ฎ๐น๐๐ฒ๐ฟ๐ป๐ฎ๐๐ถ๐๐ฒ๐น๐ ๐ฆ๐๐
ย ย โข You can't protect what you can't see
ย ย โข Know exactly what's in your build before it ships
โฏ๏ธ ๐ฆ๐ถ๐ด๐ป ๐๐ผ๐๐ฟ ๐ฎ๐ฟ๐๐ถ๐ณ๐ฎ๐ฐ๐๐! ๐ฆ๐ถ๐ด๐ป ๐๐ผ๐๐ฟ ๐ฎ๐ฟ๐๐ถ๐ณ๐ฎ๐ฐ๐๐!! ๐ฆ๐ถ๐ด๐ป ๐๐ผ๐๐ฟ ๐ฎ๐ฟ๐๐ถ๐ณ๐ฎ๐ฐ๐๐!!!
ย ย โข Downstream consumers need a way to verify provenance
Supply chain attacks don't announce themselves. By the time you notice, the damage is already in production.
Has your team audited your lockfiles since this incident?
Supply chain hardening is part of every DevSecOps maturity model. DM me or book a discovery call: https://t.co/sflOWZUm4e
๐ฐ Source: The Hacker News https://t.co/sV1Tb99rHl
Follow Azeez Adeniji for more posts on DevSecOps and supply chain security.
๐ ๐๐ถ๐ป๐ด๐น๐ฒ ๐ฝ๐ฟ๐ผ๐บ๐ฝ๐ ๐ต๐ถ๐ท๐ฎ๐ฐ๐ธ๐ฒ๐ฑ ๐ฎ๐ป ๐๐ป๐๐๐ฎ๐ด๐ฟ๐ฎ๐บ ๐ฎ๐ฐ๐ฐ๐ผ๐๐ป๐ ๐น๐ฎ๐๐ ๐๐ฒ๐ฒ๐ธ. No ๐ฬฒ๐ฬฒ๐ฬฒ๐ฬฒ๐ ฬฒ๐ฬฒ๐ฬฒ๐ฬฒ. No phishing link.
๐๐๐๐: "Change the email on this account." Meta's AI customer support agent did it!
This is what happens when AI agents get deployed without threat modeling.
๐๏ธ STRIDE has been a standard for 20 years; it maps perfectly to AI agent attack surfaces. But most teams skip it.
Here's what a proper AI agent security review should catch:
1. No input validation on privileged actions
ย ย โข Agents shouldn't execute account changes on raw user input
ย ย โข Every privileged action needs intent verification
2.ย No step-up authentication
ย ย โข Changing an email or password isn't a low-risk action
ย ย โข It requires re-auth or out-of-band verification
3. No social engineering guardrails
ย ย โข The agent trusted the prompt at face value
ย ย โข That's not a model failure, it's an architecture failure
4. No audit trail on agent decisions
ย ย โข If the agent acts, you need to know why with logs
AI agents that touch authentication are high-value targets. Treating them like chatbots is a design flaw, not a feature gap.
Has your team done threat modeling for any AI features that touch user data or auth flows?
This is exactly what Azeam's MVP Security Review covers. DM me or book a discovery call:
AI agents that touch authentication are high-value targets. Treating them like chatbots is a design flaw, not a feature gap.
Has your team done threat modeling for any AI features that touch user data or auth flows?
This is exactly what Azeam's MVP Security Review covers. DM me or book a discovery call: https://t.co/sflOWZUm4e
Azeam's MVP Security Review: https://t.co/Lnabg3xlaC
Source: 404 Media https://t.co/ioDNsnFIeX
Invitation to the
SPECIAL NATIONAL
CONVENTION
for the Ratification of the Nomination of
President Goodluck Ebele Jonathan GCFR
as the Presidential Candidate of the Peoples Democratic Party (PDP) @OfficialPDPNig
DATE: SATURDAY, 30TH MAY 2026
VENUE: 'A' CLASS EVENT CENTRE, KASSIM IBRAHIM WAY, WUSE 2, ABUJA.
TIME: 10:00AM
Comrade Ini Ememobong mnipr
National Publicity Secretary
Hon. Theophilus Dakas Shan
National Organising Secretary
"It's behind VPN. Only internal users can reach it."
I hear this every time I flag a cleartext protocol in an internal environment. Sometimes it's ZTNA instead of VPN. The confidence is always the same. So is the misunderstanding.
VPN and ZTNA solve an access problem. Cleartext protocols have a protocol problem. These are not the same thing, and one does not fix the other.
Here's what most engineers miss: VPN encrypts the tunnel from a user's machine to the network perimeter. Once that tunnel terminates, traffic flows onto the internal segment in whatever protocol the application is using.
For instance, FTP credentials, HTTP session tokens, and LDAP bind passwords are exposed to any host on that segment running Wireshark or a similar tool. No exploitation required.
ZTNA is a genuine improvement in the sense that brokers access only to specific applications rather than the whole network. But it doesn't touch what happens inside the protocol. A compromised internal host or malware from a phishing hit or a malicious insider is outside the boundary ZTNA is protecting.
Access controls and protocol security are complementary. Treating one as a substitute for the other is a reasoning gap that shows up in breach post-mortems more often than it should.
I broke down the full mechanics, including the ZTNA threat model gaps, a concrete CI/CD pipeline illustration, and what SOC 2 auditors will actually ask in my latest article on Medium.
Link here...
https://t.co/D2IXpfDbiF
#DevSecOps #CyberSecurity #ZeroTrust #CloudSecurity
The same society that produced @Eniolorunda also produced the talent he says he canโt find.
The problem isnโt supply. Itโs strategy
500 unfilled roles doesnโt mean 500 unqualified Nigerians. It means your best candidates arenโt in your pipeline because you havenโt gone to get them.
Talents are already billing in dollars with Turin and Upwork. Some are already with your competitors. While quite a large number have moved abroad, doing jobs that they are overqualified for. A number of professional will be willing to come home for the right offer.
But the offer has to make sense. Companies like Andela pay Nigerian talent thousands of USD monthly. If your annual package doesnโt match what they earn in a quarter, the math doesnโt work.
For the diaspora, incentivize them with real relocation support, housing close to work, dollar-equivalent pay. Not an office on VI and a flat in Ilupeju.
As someone who has let go of more people than Iโve hired while building a new business. I understand the frustration. But frustration isnโt a hiring strategy.
Use executive search firms. Poach. Go after the diaspora with a compelling offer.
Recruit like a company that actually competes globally.
โNigerians are not smartโ isnโt a diagnosis. Itโs an entrepreneur who hasnโt interrogated his own process.
The talent is there. Go find it
While I was busy helping critical business sectors secure products and customer data, I was quietly building something else.
A 15-unit serviced apartment complex in Lagos, Nigeria. The neighborhood I grew up in.
Private cinema. Swimming pool. Gym. And now 80% complete.
But here's what makes this different from every other apartment block on Lagos Mainland:
I'm engineering it, not just building it.
๐ No key handover: Guests receive an access code on their phone at booking confirmation.
๐ค An AI concierge welcomes every guest and onboards them from day one.
"Tell the lights to come on. Set your ambiance. Watch the robotic curtains respond to your voice."
๐ฌ A custom AI chatbot trained on house rules and pricing so no guest ever feels abandoned or confused.
๐ฒ Voice command: "I need more towels" โ instant WhatsApp alert to the manager. No front desk overhead. No waiting.
This is not just real estate. This is hospitality infrastructure where data, automation, and AI work behind the scenes so every occupant feels like a premium guest.
I will be documenting this journey and sharing the tech stack behind it as we approach launch.
If you're in hospitality, PropTech, or just curious, follow along.
Should you preempt the answer to a question you asked? Journalist are expected to be neutral, but many can't hide their partisanship. Thought channels tvโฆโฆโฉ were neutral.
She said "your President"
On implementing a structured identity access management structure:
Every action becomes traceable
Privilege escalation risks dropped significantly
CI/CD pipelines became keyless
Security teams will stop guessing and start seeing everything. Thatโs good identity architecture
If you donโt fix IAM architecture, hereโs what happens:
A leaked key gives full access, but no one knows who used it, and Incident response becomes chaos
But if you do:
- Access is temporary
- Every action is logged
- Blast radius is controlled
Same cloud, but different outcome
Hereโs the model I'd implement:
1. โ Disable service account creation (org level)
2. ๐ข Create a central identity project
3. ๐ No service account keys (ever)
4. ๐ Use cred impersonation everywhere
5. ๐ Use Workload Identity Federation for CI/CD
...
What's the Modus behind their agitation? If it's to form a caliphate, can that be negotiated, probably a community should be ceeded to them to have their self styled government and not interfere with other part of the country. This idealogical fight is too costly, how long are we going to continue to service this menace
You donโt need wickedness to escape poverty.
A year after I graduated, my father died.
No job. Just a small shop selling used computers.
Only graduate in my family.
I didnโt turn cold, I stepped up.
Took 2 full-time jobs. Trained my siblings. Carried more than I had.
Today?
3 of them are graduates.
One is studying in the UK, fully sponsored by me.
I just moved another to a private university.
I didnโt wait for my cup to be full.
Because it may never be.
The system is broken, yes!
but thatโs not an excuse to stop caring.
You donโt need wickedness to rise.
You need responsibility.
โFor at least 5 years of your life, you need a level of w+ckedness to escape p%verty, you may have to watch people you love sยฅffer and not do anything about itโ โ Man says
Thanks for this piece @IgumaScott, you nailed it right there. Our people have to look in the right direction; we are not asking what the closest government, the state, and the LGA are doing with our monthly allocation.
There's too much focus on the federal government that people forget how close the local government. If we hold the LGA's accountable, lots of the fundamental issues we complain about would be resolved.
If you're running GCP and still using service account keys..
Youโre carrying unnecessary risk.
Start here:
* Disable key creation
* Move to impersonation
* Centralize service accounts
Or better,
Build a proper identity model.
I can share a blueprint if you're interested
#SecOps
There is a growing pattern I keep seeing across teams:
IAM policies are growing out of control
No clear ownership
Zero auditability
As a practitioner, here are the simple principles I would recommend:
๐ Donโt distribute credentials
๐ Distribute the ability to impersonate