Adan Álvarez · Principal Security Architect & Researcher
I help security keep up with AI, and with the attackers who use it.
AWS Community Builder
How I see it
Every company is changing because of AI. Security has to help that change happen, change how it works itself, and face attackers who now use AI too. All at the same time.
Help the company adopt AI safely instead of blocking it, from AI services in AWS to the agents teams build on top of them.
Rethink how security works: automate the repetitive, use AI where it earns its place, and help people grow into engineers. Not everything needs an agent.
Contain attackers who move at machine speed with solid fundamentals, like segmentation, deception and good alerts, plus AI where it adds speed.
Featured research
Experiments with real CloudTrail data, published with the data and the code so you can run them yourself.
With no AWS-specific guidance, an AI agent went from a leaked key to data exfiltration in about a minute, in 7 of 12 runs. An alert would most likely arrive after the damage is done.
Fourteen models, thirteen post-compromise scenarios. They ran the old playbook at machine speed: existing detections still work, and now we know which ones they trigger most.
Writing
It’s well known that one of the most common ways attackers gain persistence in an AWS account after compromise is by creating a new IAM user, attaching an Administrator policy,…
It frustrates me that Detection Engineering still feels fragmented when it comes to the context and links between threat intelligence, detection ideas, and detection rules, and in…
While I was reading about the new AWS features released during the “pre:Invent” season, I noticed the new aws login command.
Open source
What LLMs reach for inside a breached AWS account, mapped to CloudTrail.
GitHub
CloudTrail events mapped to real-world incidents, research and MITRE ATT&CK.
176GitHub stars
AWS-native, serverless detection: write simple rules as code and get rich alerts.
52GitHub stars
Deploy honeyservices in AWS that alert on unauthorized access.
52GitHub stars
If you're figuring out how to approach security in your company, or what AI means for it, I'm always happy to chat.
Message me on LinkedIn
