Insights
Articles on manufacturing visual inspection, AWS S3 behavioral security, and the engineering behind Entroptics Vision and Shield.
Why Rigid Machine Vision Breaks on Real Production Lines
Custom-built inspection systems work on the day they are commissioned. Then the line changes. Here is why, and what a configurable inspection workflow does differently.
Keeping People in the Inspection Loop
Operators know things no model has seen yet. How operator review, traceable corrections, and controlled retraining make visual inspection better over time.
GuardDuty Catches Known Threats. What Catches the Unknown Ones?
GuardDuty catches known attack signatures. But what happens when the threat doesn't match one? Behavioral analysis fills the gap that signatures can't cover.
Anatomy of a Detection: How Multiple Signals Converge on a Single Verdict
Every S3 event gets scored by 14 independent detectors in parallel. Here's the architecture behind turning CloudTrail metadata into security signals worth investigating.
The S3 Insider Threat Your SIEM Won't Catch
Insider threats don't look like attacks. They look like normal work — until you compare them against behavioral baselines. Here are three real-world S3 exfiltration patterns and why traditional tools miss them.
Your RAG Pipeline Is an Unmonitored IAM Role
Every AI agent, LLM data pipeline, and retrieval-augmented generation system runs as an IAM role with S3 access. Most organizations have no behavioral baseline for these identities — and attackers know it.
S3 Ransomware: The 4-Step Attack Your Tools Miss
S3-targeted ransomware follows a predictable 4-step pattern. Each step uses valid IAM credentials. GuardDuty catches none of it. Here's what the attack looks like in CloudTrail — and what stops it.
What Is OCSF and Why Your S3 Detection Tool Needs It
If your detection tool doesn't output OCSF, your findings need custom transformation before Security Hub, Splunk, or any downstream tool can use them. Here's what OCSF is and why it matters.
The Difference Between NHI and Human IAM Roles in CloudTrail
CloudTrail records every S3 access, but it doesn't tell you whether a human or a Lambda function made the call. Here's how to distinguish non-human identities from human actors — and why it changes your detection strategy entirely.
From Alert Fatigue to Signal Clarity: Building S3 Security Operations
Half your alerts are false positives. Context-aware baselines and multi-signal scoring can fix that. Here's how we cut investigation time from 30 minutes to under 5.
We Added MCP and A2A to Entroptics. Here's What It Actually Does.
MCP and A2A let AI security tools query our detection data and act on findings. We shipped it. Here's what works, what doesn't, and where it matters for SOC teams.
We Let an AI Agent Triage Our Security Alerts. Here's What Happened.
We wired Claude into our detection pipeline via MCP and watched it investigate real findings. It was faster than us. It also found a bug we missed.