Threat Modeling That Produces Testable Controls
A practical method for turning system boundaries and abuse paths into owned controls, observable evidence, and repeatable tests.
Published
Author profile
Bryan Oubaita
Creator and owner of Baitaphish, publishing practical work on cybersecurity, cloud and AWS security, identity, phishing defense, AI security, and agent governance.
About
Security work grounded in inspectable evidence
Bryan Oubaita created Baitaphish and publishes practical cybersecurity education and source-linked research.
His work focuses on cloud and AWS security, identity, phishing defense, AI security, and agent governance. Baitaphish separates original analysis from source records and makes provenance, review dates, automation, and limitations visible.
Focus areas
Topics
- Cybersecurity
- Cloud and AWS security
- Infrastructure security
- Identity security
- Phishing defense
- AI security
- Agent governance
Published on Baitaphish
Research
Why Provenance Matters in Security Intelligence
Provenance turns a security claim into a traceable record of source, transformation, review, and intended use—without pretending lineage alone guarantees truth.
Published
NIST SP 800-61r3: Incident Response and Cybersecurity Risk Management
NIST's current incident-response guidance integrates preparation, response, recovery, and continuous improvement across the six CSF 2.0 Functions.
Published
Repo Brief: Open Policy Agent (OPA) — Policy-as-code for authorization and guardrails
OPA lets you centralize policy decisions (Rego) for authz and compliance across microservices, Kubernetes, CI, and more.
Published
Repo Brief: SigmaHQ/Sigma (Portable Detection Rules)
Sigma is a detection-rule format that lets you write once and translate to multiple SIEM backends (Splunk, Sentinel, etc.).
Published
SLSA: Supply-chain Levels for Software Artifacts (What to actually implement)
SLSA is a maturity model for build provenance and tamper resistance. The real value is disciplined build pipelines and signed attestations.
Published
Editorial approach
Separate evidence, interpretation, and automation
Baitaphish writing names its sources, records review dates, labels AI assistance, and states what the available evidence cannot establish. Corrections should preserve the history of a claim rather than silently replacing it.