Vvanakor

writing

Writing

Agent security, observability and detection engineering — in print and in the open.

Published elsewhere

MISC Magazine n°147September 2026print · FR

Memory poisoning: when the AI agent becomes the SOC's blind spot

A technical analysis of memory poisoning against large language model agents, and a structured approach to detection and governance for SOC teams. Memory poisoning is persistence, not exploitation: it hides in what the agent believes, which is exactly where signature detection and action-focused behavioural analysis are not looking.

memory-poisoningagent-securityllmsocdetection
View the issue →

Articles

AI & Security2 min read

What agentic AI actually changes in a SOC

Not that models can reason — that they can act. Action is where the risk moved, and most of the interesting problems are downstream of it.

Agentic AISOCAutomation
Architecture3 min read

ARGOS: building a SOC agent you would let near production

Detection speed and operational safety as co-equal constraints — and the mechanical guardrails that make that claim testable.

ARGOSAgentic AIArchitectureDetection
Observability2 min read

Your SRE team already built your security telemetry

Two teams instrument the same systems and ship two pipelines. Share collection and transport; keep retention and access separate.

ObservabilityOpenTelemetrySRESIEM
Data Security2 min read

Zero trust fails on friction, not architecture

Everyone can draw the diagram. The programmes that fail do so because verification got expensive enough that teams routed around it.

Zero TrustData SecurityArchitectureEncryption
Detection3 min read

Detection engineering: rules you can move, and rules you can retire

Portability and performance pull in opposite directions, and the detections nobody dares delete are the ones costing you the most.

Detection EngineeringSigmaMITRE ATT&CKThreat Hunting