Adeniji Azeez

IT Consultant with expertise in Enterprise Application Development, Cloud Engineering and Cyber Security

[Fahad Amir @FahadAmirN]

I SUMMARIZED THIS EXCHANGE

🇿🇦: We are against illegals in SA

🇳🇬: But I am not illegal

🇿🇦: We don’t want foreigners who take our jobs

🇳🇬: I created jobs for South Africans

🇿🇦: We just want you to leave our country even if you created jobs & are documented

🇳🇬: No problem, pay what I invested, I will leave

🇿🇦: We will see you on June 30th

NOTE: That business might get destroyed & the owner killed if this issue is not handled swiftly.

[Adeniji Azeez @AdenijiAzeez]

𝟳𝟳% 𝗼𝗳 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 𝗮𝗿𝗲 𝗿𝘂𝗻𝗻𝗶𝗻𝗴 𝗔𝗜 𝗶𝗻 𝘁𝗵𝗲𝗶𝗿 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘀𝘁𝗮𝗰𝗸.
𝗢𝗻𝗹𝘆 𝟯𝟳% 𝗵𝗮𝘃𝗲 𝗮 𝗳𝗼𝗿𝗺𝗮𝗹 𝗔𝗜 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗽𝗼𝗹𝗶𝗰𝘆.

That's from the Cloud Security Alliance's State of AI Cybersecurity 2026 report, which surveyed 1,500+ security leaders.

Think about what that gap means operationally.
Your team uses AI to detect threats, triage alerts, and automate responses. But there's no documented policy governing how those tools are authorized, audited, or constrained.
When a SOC 2 auditor asks, "How do you govern AI in your security operations?" Most teams don't have an answer.

That's not a compliance checkbox problem. It's a risk posture problem.
Here's a high-level of what AI governance in a security program actually requires:

- Authorization scope per AI tool
- Audit trail requirements
- Escalation thresholds
- Vendor risk classification

Your AI tools are third-party dependencies
They need the same scrutiny as any other vendor in your stack

AI tools without governance boundaries aren't just a compliance gap. They're an unmonitored attack surface.
What's the biggest governance gap you've seen in AI security deployments?

If you're approaching a SOC 2 audit with AI in your stack, this conversation needs to happen before the auditor asks. DM me or book a discovery call: https://t.co/sflOWZUm4e

📰 Source: CSA State of AI Cybersecurity 2026 https://t.co/m6MWjpZ0ZV

[Adeniji Azeez @AdenijiAzeez]

𝗜𝗻 𝘀𝗶𝘅 𝗺𝗶𝗻𝘂𝘁𝗲𝘀, 𝟭𝟲𝟬+ 𝗽𝗮𝗰𝗸𝗮𝗴𝗲𝘀 𝘄𝗲𝗿𝗲 𝗰𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱. That's how long "Mini Shai-Hulud" needed to move through the TanStack ecosystem.

It stole CI/CD credentials by hijacking legitimate pipeline workflows. It reached Mistral AI, UiPath, and OpenSearch. Two OpenAI employee devices were infected.

This isn't a fairytale. It happened inside production pipelines at companies that thought their dependencies were clean.

Here's what your team should be doing right now:
⏯️ 𝗔𝘂𝗱𝗶𝘁 𝘆𝗼𝘂𝗿 𝗹𝗼𝗰𝗸𝗳𝗶𝗹𝗲𝘀
  • Check for @tanstack/* and related packages; you may use a code repository filter for a quick check
  • If a version was pinned before the patch, assume exposure

⏯️ 𝗣𝗶𝗻 𝘆𝗼𝘂𝗿 𝗱𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝗰𝘆 𝘃𝗲𝗿𝘀𝗶𝗼𝗻𝘀 𝗲𝘅𝗽𝗹𝗶𝗰𝗶𝘁𝗹𝘆, 𝘁𝗵𝗼𝘂𝗴𝗵 𝗰𝗼𝗻𝘁𝗲𝘅𝘁𝘂𝗮𝗹
  • Floating versions let attackers ride legitimate update channels and cadence
  • Pinning forces a human decision before anything changes

⏯️ 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁 𝗦𝗕𝗢𝗠 𝗴𝗲𝗻𝗲𝗿𝗮𝘁𝗶𝗼𝗻 𝗼𝗿 𝗮𝗹𝘁𝗲𝗿𝗻𝗮𝘁𝗶𝘃𝗲𝗹𝘆 𝗦𝗖𝗔
  • You can't protect what you can't see
  • Know exactly what's in your build before it ships

⏯️ 𝗦𝗶𝗴𝗻 𝘆𝗼𝘂𝗿 𝗮𝗿𝘁𝗶𝗳𝗮𝗰𝘁𝘀! 𝗦𝗶𝗴𝗻 𝘆𝗼𝘂𝗿 𝗮𝗿𝘁𝗶𝗳𝗮𝗰𝘁𝘀!! 𝗦𝗶𝗴𝗻 𝘆𝗼𝘂𝗿 𝗮𝗿𝘁𝗶𝗳𝗮𝗰𝘁𝘀!!!
  • Downstream consumers need a way to verify provenance

Supply chain attacks don't announce themselves. By the time you notice, the damage is already in production.
Has your team audited your lockfiles since this incident?

Supply chain hardening is part of every DevSecOps maturity model. DM me or book a discovery call: https://t.co/sflOWZUm4e

📰 Source: The Hacker News https://t.co/sV1Tb99rHl

Follow Azeez Adeniji for more posts on DevSecOps and supply chain security.

[Adeniji Azeez @AdenijiAzeez]

𝗔 𝘀𝗶𝗻𝗴𝗹𝗲 𝗽𝗿𝗼𝗺𝗽𝘁 𝗵𝗶𝗷𝗮𝗰𝗸𝗲𝗱 𝗮𝗻 𝗜𝗻𝘀𝘁𝗮𝗴𝗿𝗮𝗺 𝗮𝗰𝗰𝗼𝘂𝗻𝘁 𝗹𝗮𝘀𝘁 𝘄𝗲𝗲𝗸. No 𝚙̲𝚊̲𝚜̲𝚜̲𝚠̲𝚘̲𝚛̲𝚍̲. No phishing link.
𝗝𝘂𝘀𝘁: "Change the email on this account." Meta's AI customer support agent did it!

This is what happens when AI agents get deployed without threat modeling.

🎛️ STRIDE has been a standard for 20 years; it maps perfectly to AI agent attack surfaces. But most teams skip it.

Here's what a proper AI agent security review should catch:

1. No input validation on privileged actions
  • Agents shouldn't execute account changes on raw user input
  • Every privileged action needs intent verification

2. No step-up authentication
  • Changing an email or password isn't a low-risk action
  • It requires re-auth or out-of-band verification

3. No social engineering guardrails
  • The agent trusted the prompt at face value
  • That's not a model failure, it's an architecture failure

4. No audit trail on agent decisions
  • If the agent acts, you need to know why with logs

AI agents that touch authentication are high-value targets. Treating them like chatbots is a design flaw, not a feature gap.

Has your team done threat modeling for any AI features that touch user data or auth flows?

This is exactly what Azeam's MVP Security Review covers. DM me or book a discovery call:

AI agents that touch authentication are high-value targets. Treating them like chatbots is a design flaw, not a feature gap.

Has your team done threat modeling for any AI features that touch user data or auth flows?

This is exactly what Azeam's MVP Security Review covers. DM me or book a discovery call: https://t.co/sflOWZUm4e

Azeam's MVP Security Review: https://t.co/Lnabg3xlaC
Source: 404 Media https://t.co/ioDNsnFIeX

[Adeniji Azeez @AdenijiAzeez]

I don’t think there’s anyone politicians can’t deceive. Tell me how they were able to corner fmr. President Jonathan into 2027 presidential race

[Official PDP Nigeria @OfficialPDPNig]

Invitation to the
SPECIAL NATIONAL
CONVENTION
for the Ratification of the Nomination of

President Goodluck Ebele Jonathan GCFR

as the Presidential Candidate of the Peoples Democratic Party (PDP) @OfficialPDPNig

DATE: SATURDAY, 30TH MAY 2026

VENUE: 'A' CLASS EVENT CENTRE, KASSIM IBRAHIM WAY, WUSE 2, ABUJA.

TIME: 10:00AM

Comrade Ini Ememobong mnipr
National Publicity Secretary

Hon. Theophilus Dakas Shan
National Organising Secretary

[Arsenal @Arsenal]

This belongs to all of us.

[Adeniji Azeez @AdenijiAzeez]

"It's behind VPN. Only internal users can reach it."

I hear this every time I flag a cleartext protocol in an internal environment. Sometimes it's ZTNA instead of VPN. The confidence is always the same. So is the misunderstanding.

VPN and ZTNA solve an access problem. Cleartext protocols have a protocol problem. These are not the same thing, and one does not fix the other.

Here's what most engineers miss: VPN encrypts the tunnel from a user's machine to the network perimeter. Once that tunnel terminates, traffic flows onto the internal segment in whatever protocol the application is using.

For instance, FTP credentials, HTTP session tokens, and LDAP bind passwords are exposed to any host on that segment running Wireshark or a similar tool. No exploitation required.

ZTNA is a genuine improvement in the sense that brokers access only to specific applications rather than the whole network. But it doesn't touch what happens inside the protocol. A compromised internal host or malware from a phishing hit or a malicious insider is outside the boundary ZTNA is protecting.

Access controls and protocol security are complementary. Treating one as a substitute for the other is a reasoning gap that shows up in breach post-mortems more often than it should.

I broke down the full mechanics, including the ZTNA threat model gaps, a concrete CI/CD pipeline illustration, and what SOC 2 auditors will actually ask in my latest article on Medium.

Link here...
https://t.co/D2IXpfDbiF

#DevSecOps #CyberSecurity #ZeroTrust #CloudSecurity

[Adeniji Azeez @AdenijiAzeez]

The same society that produced @Eniolorunda also produced the talent he says he can’t find.

The problem isn’t supply. It’s strategy

500 unfilled roles doesn’t mean 500 unqualified Nigerians. It means your best candidates aren’t in your pipeline because you haven’t gone to get them.

Talents are already billing in dollars with Turin and Upwork. Some are already with your competitors. While quite a large number have moved abroad, doing jobs that they are overqualified for. A number of professional will be willing to come home for the right offer.

But the offer has to make sense. Companies like Andela pay Nigerian talent thousands of USD monthly. If your annual package doesn’t match what they earn in a quarter, the math doesn’t work.

For the diaspora, incentivize them with real relocation support, housing close to work, dollar-equivalent pay. Not an office on VI and a flat in Ilupeju.

As someone who has let go of more people than I’ve hired while building a new business. I understand the frustration. But frustration isn’t a hiring strategy.

Use executive search firms. Poach. Go after the diaspora with a compelling offer.

Recruit like a company that actually competes globally.
“Nigerians are not smart” isn’t a diagnosis. It’s an entrepreneur who hasn’t interrogated his own process.

The talent is there. Go find it

[Adeniji Azeez @AdenijiAzeez]

While I was busy helping critical business sectors secure products and customer data, I was quietly building something else.

A 15-unit serviced apartment complex in Lagos, Nigeria. The neighborhood I grew up in.

Private cinema. Swimming pool. Gym. And now 80% complete.

But here's what makes this different from every other apartment block on Lagos Mainland:

I'm engineering it, not just building it.

🔐 No key handover: Guests receive an access code on their phone at booking confirmation.

🤖 An AI concierge welcomes every guest and onboards them from day one.
"Tell the lights to come on. Set your ambiance. Watch the robotic curtains respond to your voice."

💬 A custom AI chatbot trained on house rules and pricing so no guest ever feels abandoned or confused.

📲 Voice command: "I need more towels" → instant WhatsApp alert to the manager. No front desk overhead. No waiting.

This is not just real estate. This is hospitality infrastructure where data, automation, and AI work behind the scenes so every occupant feels like a premium guest.

I will be documenting this journey and sharing the tech stack behind it as we approach launch.
If you're in hospitality, PropTech, or just curious, follow along.

[Adeniji Azeez @AdenijiAzeez]

Should you preempt the answer to a question you asked? Journalist are expected to be neutral, but many can't hide their partisanship. Thought channels tv⁦⁦⁩ were neutral.

She said "your President"

[Adeniji Azeez @AdenijiAzeez]

On implementing a structured identity access management structure:

Every action becomes traceable
Privilege escalation risks dropped significantly
CI/CD pipelines became keyless

Security teams will stop guessing and start seeing everything. That’s good identity architecture

[Adeniji Azeez @AdenijiAzeez]

If you don’t fix IAM architecture, here’s what happens:

A leaked key gives full access, but no one knows who used it, and Incident response becomes chaos
But if you do:
- Access is temporary
- Every action is logged
- Blast radius is controlled

Same cloud, but different outcome

[Adeniji Azeez @AdenijiAzeez]

...Result?

✔️ No secrets
✔️ Full audit trail
✔️ Centralized control

Simple. Repeatable. Secure.
#secops #devsecops #iam #security

[Adeniji Azeez @AdenijiAzeez]

Here’s the model I'd implement:

1. ❌ Disable service account creation (org level)
2. 🏢 Create a central identity project
3. 🔐 No service account keys (ever)
4. 🔄 Use cred impersonation everywhere
5. 🔗 Use Workload Identity Federation for CI/CD
...

[Adeniji Azeez @AdenijiAzeez]

What's the Modus behind their agitation? If it's to form a caliphate, can that be negotiated, probably a community should be ceeded to them to have their self styled government and not interfere with other part of the country. This idealogical fight is too costly, how long are we going to continue to service this menace

[Adeniji Azeez @AdenijiAzeez]

You don’t need wickedness to escape poverty.

A year after I graduated, my father died.
No job. Just a small shop selling used computers.
Only graduate in my family.

I didn’t turn cold, I stepped up.

Took 2 full-time jobs. Trained my siblings. Carried more than I had.

Today?
3 of them are graduates.
One is studying in the UK, fully sponsored by me.
I just moved another to a private university.

I didn’t wait for my cup to be full.

Because it may never be.

The system is broken, yes!
but that’s not an excuse to stop caring.

You don’t need wickedness to rise.
You need responsibility.

[Instablog9ja @instablog9ja]

“For at least 5 years of your life, you need a level of w+ckedness to escape p%verty, you may have to watch people you love s¥ffer and not do anything about it” — Man says

[Adeniji Azeez @AdenijiAzeez]

Thanks for this piece @IgumaScott, you nailed it right there. Our people have to look in the right direction; we are not asking what the closest government, the state, and the LGA are doing with our monthly allocation.

[scott iguma @IgumaScott]

Hold your governors and local governments chairmen accountable.

[Adeniji Azeez @AdenijiAzeez]

There's too much focus on the federal government that people forget how close the local government. If we hold the LGA's accountable, lots of the fundamental issues we complain about would be resolved.

[scott iguma @IgumaScott]

Start holding your governors accountable for the electricity in your state.

[Adeniji Azeez @AdenijiAzeez]

If you're running GCP and still using service account keys..

You’re carrying unnecessary risk.
Start here:
* Disable key creation
* Move to impersonation
* Centralize service accounts

Or better,
Build a proper identity model.
I can share a blueprint if you're interested
#SecOps

[Adeniji Azeez @AdenijiAzeez]

There is a growing pattern I keep seeing across teams:

IAM policies are growing out of control
No clear ownership
Zero auditability

As a practitioner, here are the simple principles I would recommend:
👉 Don’t distribute credentials
👉 Distribute the ability to impersonate