Research area

Cloud &
infrastructure

Cloud accounts, Kubernetes platforms, and the pipelines that deploy them. We find the over-trusted identity, the isolation that only exists on paper, and the configuration that quietly undoes both.

Propose a collaboration

Targets: IAM · Kubernetes · IaC
Focus: Identity & isolation
Location: Europe · Remote

The problem

One over-trusted identity is often the whole breach.

Configuration scanners report what is misconfigured. The question that decides impact is what an attacker can reach from there.

Cloud and container platforms concentrate authority in a small number of identities, policies, and pipelines. A single permissive role, a workload that can read its node's credentials, or a pipeline that trusts the wrong input can turn an ordinary foothold into control of the environment.

We start where an attacker would start, from a foothold they could realistically get, and show how far it goes.

Targets

Where identity and isolation decide the outcome.

The accounts, clusters, and pipelines where one over-trusted identity or one permissive policy decides what an attacker can reach.

Cloud IAM, roles, and privilege-escalation paths
Kubernetes clusters and container platforms
Workload, tenant, and account isolation
Infrastructure-as-code and configuration review
CI/CD pipelines and deployment trust
Network segmentation and service-to-service authorization

Approach

How we test infrastructure.

Identity is the perimeter

In cloud environments the boundary that usually decides the outcome is identity. That means roles, trust policies, workload credentials, and the chains that turn a narrow foothold into broad control. We map those paths and say which ones we exercised and which we only read in policy.

Isolation is a claim to test

Accounts, namespaces, node pools, and networks are meant to keep workloads apart. We test whether they do from inside a compromised workload, not from an architecture diagram.

Configuration is code

Infrastructure-as-code, admission policy, and deployment pipelines decide what runs in production. We review them as code an attacker can abuse, and trace each finding to the line that causes it.

Managed does not mean finished

Managed services move the boundary. They do not remove it. We study where workloads meet the services they trust: metadata endpoints, service accounts, and cross-account access.

Cloud & infrastructure

Mapping the same privilege paths?

If you are researching cloud identity, Kubernetes isolation, or deployment-pipeline trust, we are open to joint research, coordinated disclosure, and shared tooling. Write to the person doing the work.

Propose a collaboration All contact options

Open to: Joint research · Disclosure · Tooling
Reply: Direct, from the researcher
Location: Europe · Remote

Cloud &infrastructure