Security on Cliff Hults

Designing an Automated Artifact Factory: A Case Study in Turning Pipeline Pain Into a Platform Boundary

Sun, 20 Sep 2026 00:00:00 +0000

Every team wiring the same three security checks into its own pipeline isn’t really a security problem. It’s a platform problem wearing a security costume.

This is the story of how we traced that pattern back to a structural issue, and the design we landed on to fix it: an automated artifact factory that turns signing, vulnerability scanning, and antivirus scanning from something every team bolts onto their own pipeline into something the platform just does for them.

The Paved Path: Making the Secure Choice the Easy Choice at Scale

Fri, 01 May 2026 00:00:00 +0000

This is the final part of a series. Start with Part 1 — giving the backlog teeth, then Part 2 — the waiver trap.

The waiver experiment was a failure in the best possible way; it was diagnostic. It told me exactly where the real bottleneck was: fixing a vulnerability was hard to do, not hard to decide. Teams weren’t ignoring the work because they were lazy or uncaring. The work to fix a dependency vulnerability was slow, manual, and painful. Every fix was a research project.

So I stopped trying to apply more pressure and started asking the question that changed everything:

What if fixing a vulnerability was the easiest possible thing to do?

When Your Security Tool Goes Down: Surviving an SCA Tool Outage

Sun, 12 Apr 2026 00:00:00 +0000

Security tooling exists to protect your organization. But what happens when the security tool itself becomes the outage?

That’s the situation we found ourselves in when an SCA tool experienced a service disruption that lasted approximately five hours. For us, it wasn’t a degraded experience; it was a complete development freeze.

Supply Chain Attacks Start in Your Build Cache

Sat, 11 Apr 2026 00:00:00 +0000

On March 25, 2025, a malicious version of the axios npm package (version 1.14.1) was published to the npm registry. It contained a bundled dependency called plain-crypto-js@4.2.0, which was later confirmed to be malicious. The package was identified and removed from the npm registry within roughly three hours.

For most organizations, three hours sounds manageable. For us, it wasn’t that simple.

The Waiver Trap: When Your Compliance Safety Valve Delays Real Remediation

Fri, 13 Feb 2026 00:00:00 +0000

Enforcement worked. Critical vulnerabilities were suddenly getting fixed on deadlines, and the backlog that had sat ignored for years started to clear. But it worked too well in one sense: the volume of new work it created across thousands of developers turned enforcement itself into a blocker.

This is the part of the story almost nobody writes about, because it’s the part that looks like a failure. It was the most instructive decision I made.

Giving the Backlog Teeth: What Enforcing Remediation SLOs Actually Requires

Fri, 06 Feb 2026 00:00:00 +0000

Every security leader has stared down a backlog of ignored vulnerabilities. You know the shape of it: thousands of open findings, tracked diligently, remediated rarely. The problem wasn’t that people didn’t care; it was that nothing was at stake for not fixing them.

I led a vulnerability-management program across a large engineering organization of thousands of developers and repositories. Early on I learned that you can’t improve what you don’t enforce. Here’s what actually happens when you give the backlog teeth, and the uncomfortable truth about what enforcing it really takes.

Log4j Scanning and Detection

Thu, 16 Dec 2021 14:59:43 -0500

Lately, everyone has been talking about Log4Shell (CVE-2021-44228) and likely, if you’re reading this, you’re looking for info for what to do. Most people attempted to utilize Huntress’s Log4Shell detection tool to show connections to a LDAP server they were hosting. Some people had issues with this as it was overburdened with requests (rightfully so) or didn’t want to, or aren’t allowed to send outbound traffic to a server they didn’t own. At our organization, we were part of the latter group. In order to comply with our rules, we needed to find a reliable way to scan our devices for the vulnerability and look for requests to a domain that we owned.