# Adan Álvarez

> Principal Security Architect & Researcher, Barcelona. Making security AI-ready: research on what AI attackers do in AWS, how security teams can work with AI, and detection engineering. Data and code are open.

## Newsletter: No Hype, No Fear

A newsletter, about once a month, on how AI is changing security for the company adopting it, for the security team, and against the attackers using it. Backed by research and my own tests, with my take and what to do about it. Every edition is available as Markdown.

- No editions yet. The first goes out in November 2026.
- [Full-text feed (RSS)](https://adan.cloud/feed.xml)

## Featured research

- [From Leaked AWS Key to Data Exfiltration in 60 Seconds: Are We Ready?](https://medium.com/@adan.alvarez/from-leaked-aws-key-to-data-exfiltration-in-60-seconds-are-we-ready-28213bc73678): With no AWS-specific guidance, an AI agent went from a leaked key to data exfiltration in about a minute, in 7 of 12 runs. An alert would most likely arrive after the damage is done.
- [I Gave 14 LLMs AWS Keys. Here’s What They Wanted to Do Next](https://medium.com/@adan.alvarez/i-gave-14-llms-aws-keys-heres-what-they-wanted-to-do-next-48585761a11b): Fourteen models, thirteen post-compromise scenarios. They ran the old playbook at machine speed. Existing detections still work, and now we know which ones they trigger most. Data: https://llms.traildiscover.cloud/

## Open-source projects

- [llm-trails](https://github.com/adanalvarez/llm-trails): What LLMs reach for inside a breached AWS account, mapped to CloudTrail.
- [cloud-ranges](https://github.com/adanalvarez/cloud-ranges): Synthetic cloud environments for testing how AI agents behave on real attack chains.
- [TrailDiscover](https://github.com/adanalvarez/TrailDiscover): CloudTrail events mapped to real-world incidents, research and MITRE ATT&CK.
- [TrailAlerts](https://github.com/adanalvarez/TrailAlerts): AWS-native, serverless detection. Write simple rules as code and get rich alerts.
- [HoneyTrail](https://github.com/adanalvarez/HoneyTrail): Deploy honeyservices in AWS that alert on unauthorized access.
- [semgrep-llm-advisor](https://github.com/adanalvarez/semgrep-llm-advisor): Semgrep findings plus LLM recommendations for faster remediation.
- [bedrock-secure-questionnaire-automation](https://github.com/adanalvarez/bedrock-secure-questionnaire-automation): Answer security questionnaires from your own knowledge base, serverless on Amazon Bedrock.
- [OWASP WSTG Tracker](https://github.com/adanalvarez/owasp-wstg-tracker): Track your progress through the OWASP Web Security Testing Guide checklists. Nothing to install.
- [AWS Incident Response Automations](https://github.com/adanalvarez/AWSIncidentResponseAutomations): Easy-to-deploy automations for incident response in AWS.
- [GuardDutyInsightfulAlerts](https://github.com/adanalvarez/GuardDutyInsightfulAlerts): Enriches GuardDuty findings with context, so alerts are easier to act on.
- [TrailGuard](https://github.com/adanalvarez/TrailGuard): Checks your CloudTrail setup and where trails are sent, to spot ways attackers could tamper with logging.
- [AWS malware lab](https://github.com/adanalvarez/AWS-malware-lab): Build your own malware analysis lab in AWS.

## Optional

- [I Gave 14 LLMs AWS Keys. Here’s What They Wanted to Do Next](https://medium.com/@adan.alvarez/i-gave-14-llms-aws-keys-heres-what-they-wanted-to-do-next-48585761a11b) (2026-10-18)
- [From Leaked AWS Key to Data Exfiltration in 60 Seconds: Are We Ready?](https://medium.com/@adan.alvarez/from-leaked-aws-key-to-data-exfiltration-in-60-seconds-are-we-ready-28213bc73678) (2026-05-10)
- [A Backdoor You Can Talk To: Persistence via Bedrock AgentCore](https://medium.com/@adan.alvarez/a-backdoor-you-can-talk-to-persistence-via-bedrock-agentcore-0db60320e737) (2026-03-01)
- [A Practical Introduction to OpenTIDE: Open Threat-Informed Detection Engineering](https://medium.com/@adan.alvarez/a-practical-introduction-to-opentide-open-threat-informed-detection-engineering-e218e4970c95) (2026-02-01)
- [Phishing for AWS Credentials via the New 'aws login' Flow](https://medium.com/@adan.alvarez/phishing-for-aws-credentials-via-the-new-aws-login-flow-39f6969b4eae) (2025-11-23)
- [Writing, Receiving, Reviewing: My Take on Penetration Test Reports](https://medium.com/@adan.alvarez/writing-receiving-reviewing-my-take-on-penetration-test-reports-f13230517de9) (2025-09-21)
- [GPT-5 vs Gemini Pro 2.5 vs Sonnet 4: Detecting Simple Vulnerabilities](https://medium.com/@adan.alvarez/gpt-5-vs-gemini-pro-2-5-vs-sonnet-4-detecting-simple-vulnerabilities-e246d21b2781) (2025-08-17)
- [API Keys for Bedrock: A Brief Security Overview](https://medium.com/@adan.alvarez/api-keys-for-bedrock-a-brief-security-overview-2133ed9a2b3f) (2025-07-13)
- [OWASP Global AppSec Barcelona 2025 Personal Recap](https://medium.com/@adan.alvarez/owasp-global-appsec-barcelona-2025-personal-recap-89bed7dc4342) (2025-06-01)
- [TrailAlerts: Take Control of Cloud Detection in AWS](https://medium.com/@adan.alvarez/trailalerts-take-control-of-cloud-detection-in-aws-9e7761f49509) (2025-05-04)
- [Gaining Long-Term AWS Access with CodeBuild and GitHub](https://medium.com/@adan.alvarez/gaining-long-term-aws-access-with-codebuild-and-github-873324638784) (2025-04-13)
- [GitHub Actions and the Pinning Problem: What 100 Security Projects Reveal](https://medium.com/@adan.alvarez/github-actions-and-the-pinning-problem-what-100-security-projects-reveal-54a3a9dcc902) (2025-03-29)
- [DIY — Evaluating AWS Native Approaches for Detecting Suspicious API Calls](https://medium.com/@adan.alvarez/diy-evaluating-aws-native-approaches-for-detecting-suspicious-api-calls-c6e05de97a49) (2025-03-03)
- [DIY — Using Semgrep with LLMs to Improve Code Reviews](https://medium.com/@adan.alvarez/diy-using-semgrep-with-llms-to-improve-code-reviews-d43d0584b34f) (2025-02-22)
- [Breached? Not Game Over: Learn How to Turn the Tables on AWS Attackers!](https://medium.com/@adan.alvarez/breached-not-game-over-learn-how-to-turn-the-tables-on-aws-attackers-1b8ec00fa83c) (2025-02-09)
- [DIY — Building a Cost-Effective Questionnaire Automation with Bedrock](https://medium.com/@adan.alvarez/diy-building-a-cost-effective-questionnaire-automation-with-bedrock-7346840dae46) (2025-01-20)
- [GetFederationToken: A Simple AWS Persistence Technique Used in the Wild](https://medium.com/@adan.alvarez/how-attackers-persist-in-aws-using-getfederationtoken-a-simple-and-effective-technique-used-in-the-987ec1f0bdfe) (2024-12-07)
- [How Attackers Can Abuse IAM Roles Anywhere for Persistent AWS Access](https://medium.com/@adan.alvarez/how-attackers-can-abuse-iam-roles-anywhere-for-persistent-aws-access-b3ced6935dca) (2024-12-06)
- [Lambda Extensions: Exploring Misuse Scenarios and Stratus Red Team Module Development](https://awstip.com/lambda-extensions-exploring-misuse-scenarios-and-stratus-red-team-module-development-b63c5a73491a) (2024-11-23)
- [Gaining AWS Persistence by Updating a SAML Identity Provider](https://medium.com/@adan.alvarez/gaining-aws-persistence-by-updating-a-saml-identity-provider-ef57ebdc8db5) (2024-11-18)
- [Discover New CloudTrail Logs on TrailDiscover, Powered by Grimoire!](https://medium.com/@adan.alvarez/discover-new-cloudtrail-logs-on-traildiscover-powered-by-grimoire-4d9e57117188) (2024-08-25)
- [Automating Incident Response in AWS: Blocking a Compromised Identity Center User](https://medium.com/@adan.alvarez/automating-incident-response-in-aws-blocking-a-compromised-identity-center-user-3273d7c02e1d) (2024-06-03)
- [Deterring Attackers with HoneyTrail: Deploying Deception in AWS](https://medium.com/@adan.alvarez/deterring-attackers-with-honeytrail-deploying-deception-in-aws-6b5977afa784) (2024-05-12)
- [What’s New in TrailDiscover: Integrating Permissions Information, Alerting, and Simulations](https://medium.com/@adan.alvarez/whats-new-in-traildiscover-integrating-permissions-information-alerting-and-simulations-dd0c63c67268) (2024-04-06)
- [Introducing TrailDiscover: Simplifying Access to Security Insights about CloudTrail Events](https://medium.com/@adan.alvarez/introducing-traildiscover-simplifying-access-to-security-insights-about-cloudtrail-events-cde14508f2e9) (2024-03-03)
- [Cybersecurity — It’s All About Trust](https://medium.com/@adan.alvarez/cybersecurity-its-all-about-trust-9abb9a80aa03) (2023-12-30)
- [Enhancing AWS GuardDuty Alerts with GuardDutyInsightfulAlerts](https://awstip.com/enhancing-aws-guardduty-alerts-with-guarddutyinsightfulalerts-b7e806518a20) (2023-12-07)
- [Rigging the Rules: Manipulating AWS ALB to Mine Sensitive Data](https://medium.com/@adan.alvarez/rigging-the-rules-manipulating-aws-alb-to-mine-sensitive-data-20e33dbc4994) (2023-10-24)
- [Distorting the Sync: How AWS AppSync Can Be Turned into an Attacker’s Backdoor](https://medium.com/@adan.alvarez/distorting-the-sync-how-aws-appsync-can-be-turned-into-an-attackers-backdoor-8c015b8e52b8) (2023-10-03)
- [How Attackers Can Misuse AWS CloudFront Access to Make It ‘Rain’ Cookies](https://medium.com/@adan.alvarez/how-attackers-can-misuse-aws-cloudfront-access-to-make-it-rain-cookies-acf9ce87541c) (2023-09-14)
- [Ensuring Alert Readiness: Lessons from Schrödinger’s Cat](https://medium.com/@adan.alvarez/ensuring-alert-readiness-lessons-from-schr%C3%B6dingers-cat-bc14f862340d) (2023-09-02)
- [What’s Missing in Your Vulnerability Management Strategy? Exploring CVSS, EPSS, KEV, and Beyond.](https://medium.com/@adan.alvarez/whats-missing-in-your-vulnerability-management-strategy-exploring-cvss-epss-kev-and-beyond-21c424207d9c) (2023-08-19)
- [Are You Just Checking Boxes? Turning Compliance into Real Security](https://medium.com/@adan.alvarez/are-you-just-checking-boxes-turning-compliance-into-real-security-40aa686ade22) (2023-08-07)
- [When a Storm Hits the Cloud: Learning from the Microsoft Breach](https://medium.com/@adan.alvarez/when-a-storm-hits-the-cloud-learning-from-the-microsoft-breach-1d4de78ba686) (2023-07-31)
- [Enhancing Security for AWS Static Websites: A PoC Implementation of Honeytokens](https://medium.com/@adan.alvarez/enhancing-security-for-aws-static-websites-a-poc-implementation-of-honeytokens-6148e8267984) (2023-07-22)
- [Cybersecurity, Here to Help: Preventing Extra Cognitive Load for Developers](https://medium.com/@adan.alvarez/cybersecurity-here-to-help-preventing-extra-cognitive-load-for-developers-5e5e51a9e80c) (2023-07-15)
- [Analyzing the SCARLETEEL Attack: Proposed Alerts for Early Detection and Response](https://medium.com/@adan.alvarez/analyzing-the-scarleteel-attack-proposed-alerts-for-early-detection-and-response-6e6758ddc904) (2023-03-04)
- [Learning from the CircleCI incident with a tabletop exercise](https://medium.com/@adan.alvarez/learning-from-the-circleci-incident-with-a-tabletop-exercise-fa265cd6d39e) (2023-01-30)
- [Cybersecurity — It’s all about risks](https://medium.com/@adan.alvarez/cybersecurity-its-all-about-risks-fc45b5279c57) (2022-10-13)
- [About Adan](https://adan.cloud/about)