awsmatt

D3FEND-AWS: Structured Defensive Mappings for the AWS Threat Technique Catalog

Sat, 25 Apr 2026 00:00:00 +0000

The AWS Threat Technique Catalog documents how attackers operate in AWS. D3FEND-AWS maps the defensive counterpart — what to detect, harden, and evict — as structured, machine-readable YAML. Open source on GitHub.

Behavioural Detection with Automated Agents: The Future of Managed Detection & Response

Mon, 20 Apr 2026 00:00:00 +0000

Rule-based detection has a ceiling. Behavioural profiling with automated agents catches what static rules miss — especially in cloud environments.

SCPs and RCPs: Using Both to Close the Preventive Control Gap

Thu, 16 Apr 2026 00:00:00 +0000

Service Control Policies restrict what your principals can do. Resource Control Policies restrict what can be done to your resources. Most AWS organisations use one or neither. Here’s why both matter.

Correlating GuardDuty Findings with CloudTrail: The Signal Gap Most Teams Miss

Tue, 10 Mar 2026 00:00:00 +0000

GuardDuty tells you something happened. CloudTrail tells you what happened next. Most teams treat these as separate workflows — and that gap is where attackers complete their objectives.

IAM Privilege Escalation in AWS: The Paths Most Teams Miss

Tue, 03 Mar 2026 00:00:00 +0000

Each step in an IAM privilege escalation chain looks like a routine API call. The attack only becomes visible when you trace the full sequence.

AWS Security Research

Sun, 01 Mar 2026 00:00:00 +0000

Introducing awsmatt.com — a home for AWS security research, tools, and practical guides.

Background

Mon, 01 Jan 0001 00:00:00 +0000

Senior cybersecurity and cloud security leader with over 25 years’ experience across incident response, security architecture, and risk management. Focused on helping organisations secure their AWS environments through practical research, tooling, and hands-on guidance.

Focus Areas

Cloud Security — AWS security architecture, misconfiguration detection, identity and access management
Incident Response — cloud-native IR, forensics in AWS, playbook development
Security Architecture — landing zone design, network segmentation, defence in depth
Identity & Access Management — IAM policy analysis, privilege escalation paths, federation
Governance & Compliance — security frameworks, risk management, audit readiness

Selected Expertise

Cloud Infrastructure AWS security services (GuardDuty, Security Hub, IAM Access Analyzer, CloudTrail, Config), infrastructure as code (Terraform, CloudFormation), container security, serverless security patterns.