Verifying Operative█

EMMANUEL TIGOUE

AI Security Engineer
CISSP, SecurityX, CCNA

I build and break agentic AI systems, then ship the guardrails and audit trails that survive a compliance review. The controls map to NIST 800-53 and ISO 42001, from the cloud edge to the local model.

Get In Touch View on GitHub

What I built

A security platform I designed, threat modeled, and run. Terraform in one repository has stood the stack up on AWS, DigitalOcean, and Oracle Cloud, one root module per provider, and runs on Oracle Cloud today. 19 services designed, 13 live, and every number on this page traces to the public repository.

Topology and flows

one hardened host, 19 services, three trust segmentsOpen full viewClick a box for what it is, the controls it holds, and the file that proves it.
request path, user to service AI agent path, screened on the way out fallback on spend ceiling detection and audit, shipped off-host change path, pipeline only internal dependency inbound SSH, break-glass external service users, operators Claude API allowlisted source range Cloudflare edge off-host, identity checked before origin, WAF and DDoS, no origin address in DNS Access WAF + DDoS Host, single hardened VM published to loopback only cloudflared host network, read-only root host sshd net-ai, sealed no route in or out n8n and Squire bridge in Whisper Ollama voice to text, on host local LLM, sealed net-core state, identity, orchestration n8n Langfuse ×4 Vault Keycloak Squire Guardrails Postgres Teleport SOAR, bridge to net-ai secrets, DB engine OIDC, realm roles SOC agent, allowlist PII, injection, policy backs five services recorded SSH, MFA, JIT every service: no-new-privileges (Falco excepted, documented), CPU, memory, and PID limits net-monitoring reads the kernel via eBPF audit shipper also on net-core Falco, eBPF Falcosidekick event handler Vector Datadog agent Object storage state + backups CMK encrypted retention rule timed restore, monthly Datadog SIEM, events, logs Delivery Terraform is the only supported path for infrastructure change, CI holds no long-lived cloud credentials pull request OIDC exchange plan, scan, lint OPA gates, 4 deny human review apply, main only nightly drift check any diff → alert HTTPS dials out, host initiates no inbound listener proxied to loopback leaves the host only here daily spend ceiling, every call traced trace short-TTL creds OIDC nightly alerts audit, gRPC mTLS audit logs logs, metrics applies re-plans against live SSH, break-glass source-restricted
Requestedge auth → tunnel dialed out → loopback, tunnel dies: site unreachable, no port opens
AIagent → guardrails → API, spend cap, traced, sealed local fallback
Detect + auditkernel → Falco → SIEM, sessions → mTLS → SIEM, sensor sits below the workloads
ChangePR → checks → policy gates → review → apply, nightly drift re-plan, CMK-encrypted state

A 19 service platform on one Oracle ARM host, 13 containers up as this page was built. Control by control detail sits in the POA&M in the GRC section.

19
Containers built
7
Attack paths modeled
9
POA&M findings closed
8
OPA policies
14
SOAR workflows as code
20
Events handled / week
8
SOAR workflows active
17
Sigma detection rules
57
GRC documents
140
NIST controls mapped
5
IR playbooks

Workload figures measured over the 7 days ending 2026-09-10. One event is one successful top level automation run.

Multi-cloud planes

three planes, three vendors, split by blast radiusOpen full viewClick a box for what it is, the controls it holds, and the file that proves it.
Edge Cloudflare identity, ingress, state Terraform: cd-cloudflare-edge Runtime Oracle Cloud compute, data, keys Terraform: cd-oci-infrastructure Security AWS what must survive the other two Terraform: cd-aws-security-plane users, operators SIEM GitHub Actions operator, Telegram AccessOTP, service tokens tunnel edgehost dials out to it WAF, rate limitsmanaged and custom rules DNS proxyno origin address webhook carve-outTelegram ranges, one path state bucketTerraform state, versioned hardened hostcompose, 19 services VCN, one portSSH, allowlisted sources identity domainJWT to token, minutes backup bucketretention rule, 30 days KMS vault + keyCMK, envelope block storageencrypted, provider key instance identitywrites, cannot delete timed restoremonthly, logged OIDC federationrepo and main, 1h max break-glass secretsealed runtime credential evidence vaultObject Lock, CMK, 30d alert on readtrail to Lambda to Telegram account trailmulti-region, validated region guarddeny outside one region evidence uploaderwrite-only, no delete one-time PIN, service tokens signed JWT, main only same JWT, role pinned nightly evidence, one way, write-only logs, alerts, metrics pages in 2 min caller named emergency read only any read If this account falls the front door and its policies fall, not the host; revoke the tunnel token and the host goes dark with its data intact If this account falls data and keys live here; the host cannot delete its own backups, and the evidence copy and the break-glass credential sit with another vendor If this account falls no automation here reaches the runtime; the uploader can only add, Object Lock refuses deletes even for root, and every access lands on a validated trail request and tunnel path pipeline identity, short-lived evidence and alerts, one way break-glass, alerted on read external service
Edgeidentity → filter → tunnel, host dials out, no origin address anywhere
Identityone GitHub JWT → two clouds, pinned to main, short-lived, read-only, no stored cloud key in CI
Evidencenightly, one way, write-only, Object Lock, survives the runtime cloud
Break-glasssealed credential in the other cloud, any read → page in 2 min

What it takes to run

$135/mo before

One AWS EC2 instance with a NAT Gateway in front of it, most of the compute idle, and every control tied to one vendor.

Multi-cloud IaC

Terraform builds the whole stack, Docker Compose runs it, and Cloudflare handles identity at the edge, so the same platform can stand up on a new provider in an afternoon. The evidence copies, backups, and break-glass credential are designed to live in a separate AWS account behind Object Lock, so the watcher never shares a failure domain with the workloads.

One ARM shape now

65% cut on DigitalOcean, then onto one Oracle Cloud Ampere A1 Flex shape, 4 OCPU and 24 GB. Same compose stack, same controls, a Terraform root per provider, three providers so far.

TERRAFORM, compute.tf (Oracle Cloud)
resource "oci_core_instance" "cd_alpha" {
  compartment_id = local.compartment
  display_name   = var.instance_name
  shape          = "VM.Standard.A1.Flex"

  shape_config {
    ocpus         = var.instance_ocpus
    memory_in_gbs = var.instance_memory_gb
  }

  source_details {
    source_type = "image"
    source_id   = data.oci_core_images.ubuntu_arm.images[0].id
  }
}
DOCKER, docker-compose.yaml
services:
  edge-tunnel:
    image: cloudflare/cloudflared:latest # digest-pinned in prod
    command: tunnel run
    network_mode: host
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    read_only: true
    environment:

  svc-automation:
    image: n8nio/n8n:latest # digest-pinned in prod
    security_opt:
      - no-new-privileges:true
    networks:
      - net-core # isolated bridge
OPA/REGO, deny_missing_prevent_destroy.rego
package main

import rego.v1

deny contains msg if {
  some rc in input.resource_changes
  rc.type in production_types
  action_includes_delete(rc)
  msg := sprintf(
    "DENY: deletion of production resource '%s'",
    [rc.address],
  )
}

Experience

CoreDirective AI Security Engineer
Atlanta, GASep 2025 to present

Independent AI security practice. The reference platform at the top of this page is its infrastructure, built and operated end to end.

  • Architected Squire, an AI SOC analyst that drafts a triage verdict for every alert and holds HIGH and CRITICAL for a human approval row. Built on LangGraph with human approval gates, pgvector RAG, NeMo Guardrails PII redaction, and Langfuse tracing
  • Threat modeled the OpenClaw gateway (Claude Fable 5) against the OWASP LLM Top 10 and MITRE ATLAS, then set the guardrail and access requirements the platform shipped with
  • Ran structured red team cycles against my own production AI stack and its web surfaces: prompt injection, jailbreaks, data leakage, excessive agency, and OWASP web risks. Remediated 6 of 11 pen test findings, the single High the same day, accepted 4 with compensating controls, and closed 1 as a false positive. Ran 20 red team cases across 5 attack classes with zero true bypasses
  • Embedded Semgrep SAST, Trivy container image and dependency scanning, Gitleaks secrets scanning, and OPA policy gates for infrastructure as code into CI/CD. Added OWASP ZAP DAST against a CI-spun n8n instance, which is advisory, and a Cosign signature check the four publishers that sign must pass
  • Placed every admin surface behind Cloudflare Zero Trust, defined in Terraform with no public application ports, one allowlisted break-glass SSH rule, and separate policies for human and service accounts
  • Tuned Falco eBPF container runtime detection shipped to Datadog and mapped to MITRE ATT&CK, cutting alert noise without losing coverage
  • Authored 57 GRC documents mapping 140 NIST 800-53 controls plus NIST AI RMF, SOC 2, and ISO 27001, and built a Promptfoo eval harness that regression tests the AI guardrail controls
Texaco IT Security & Operations Manager
Atlanta, GAMar 2022 to Mar 2026
  • Deployed Splunk Enterprise SIEM across 3 sites, centralizing FortiGate, Cisco switch, and Windows logs with on call alerting and a one year AWS S3 archive under Object Lock. Detection time fell from 48 hours to under 4
  • Owned incident response for 45 endpoints, covering card skimming, credential compromise, and unauthorized vendor access. Wrote a 6 step IR runbook that reduced containment from 8 hours to 90 minutes
  • Traced $18K a year in card fraud to skimming on outdated, tamper prone payment terminals and drove their replacement with current models on automatic vendor updates
  • Segmented a flat network into 6 VLANs behind FortiGate zones with default deny, isolating payment systems and tank gauges. Verified with Nmap and closed 12 of 14 critical PCI DSS gaps
  • Built a quarterly Nessus vulnerability management cycle with patch reporting automated in Python and PowerShell, and brought critical patching from 90 to 30 days
  • Removed standing admin rights and hardened Active Directory and Entra ID with MFA, FIDO2 admin keys, GPO baselines, stale account cleanup, and credential rotation

Security engineering

This section takes apart an autonomous AI agent that can browse, run code, query databases, trigger SOAR workflows, and push to GitHub. One compromised prompt can chain through 6 skills into 16 downstream integrations. I decomposed the pipeline with STRIDE, cross-referenced MITRE ATT&CK and ATLAS, OWASP Top 10 for LLM Applications (2026), NIST 800-53, and ISO 42001, and came out with 29 threats, 7 attack paths, and a clear line between the controls that hold and the gaps that remain.

29
Threats found across 8 trust boundaries
7
Attack paths modeled
20
Red team cases, zero true bypasses
5
Risks accepted in writing, with controls

Threat model

six attacker positions, the wall that meets each one, and what remains after the wallsOpen full viewClick a box for what it is, the controls it holds, and the file that proves it.
internet scanner any host, no credential no origin IP in DNS Edge SC-7 I WAF, DDoS absorbed Edge SC-5 D no ports, dials out Host SC-7 S SSH allowlist only Host SC-7 D TB-1 Reaches the edge login page and the public webhook paths, never the host or its address Low D-01 S-05 webhook caller knows a public webhook path WAF and per-IP limit Edge SC-5 D edge auth, 1 carve-out Edge AC-3 S token header on Squire App IA-5 S typed payload, schema App SI-10 T recommend-only actions App AC-6 E traced, human on HIGH App AU-12 R TB-2, TB-7 Reaches one forged alert into a recommend-only pipeline; a human reads anything HIGH Medium S-01 hostile prompt attacker text in an alert PII scrubbed pre-graph App SI-10 I jailbreak and PII rail App SI-4 T output rail, citations App SI-7 T forbidden-verb filter App AC-6 E human gate on HIGH App IR-4 E spend cap, traced App AU-12 R TB-5 Reaches the allowlist: text advice, no action executes; 20 cases fired, 0 bypasses Medium T-01 I-01 compromised container code running in one service three bridge networks Runtime AC-4 E no-new-privs, 1 exempt Runtime CM-7 E socket: 2 sensors only Runtime AC-6 E Falco reads the kernel Runtime SI-4 E secrets need a token Identity IA-5 I DB needs a credential Data AC-3 I TB-4 Reaches its own segment and env; host escape needs a kernel zero-day and lands in Falco Medium E-04 E-01 S-03 stolen credential a password or a laptop one-time PIN at edge Edge IA-2 S second factor on SSH Host IA-2 S JIT expires in 4h Identity AC-12 E quarterly role review Identity AC-2 E recorded, shipped mTLS Identity AU-9 R TB-1 TB-2 Reaches a recorded session with a four hour clock; evidence lands beyond their reach Low R-02 E-03 poisoned image a tag nobody here built digest pinned, Tier 1 Delivery CM-5 T reviewed PR to change Delivery CM-3 T scan, SBOM, signature Delivery RA-5 T sealed: no route home Runtime AC-4 I Reaches a poisoned tag needs a reviewed PR; a bad runtime has no route home Low T-05 T-03 By the numbers 29 STRIDE threats across 8 trust boundaries 7 attack paths, 4 platform, 3 AI 10 AI threats cataloged, OWASP LLM and ATLAS 20 red-team cases fired, 0 bypasses 11 pentest findings, 0 critical, 4 accepted 0 application ports open to the internet STRIDE S spoofing T tampering R repudiation I information disclosure D denial of service E elevation of privilege Reading the page the attack, top to bottom what remains after a wall wall that stops it, STRIDE letter sees it, cannot be silenced inside trust boundary crossed, register ID residual after controls, register IDs
MethodSTRIDE per trust boundary, attack trees per AI path, two red-team cycles fired at production
Readingtop to bottom is the attack, each bar is a wall, dashed is what remains, chip is residual after controls
DetectionFalco from the kernel, logins and sessions off-host over mTLS, every model call traced
ResidualMEDIUM carries a named mitigation or acceptance; the one High in the platform register (I-02) is re-rated Moderate by the risk register; reviewed quarterly

Threat inventory (STRIDE)

Select any category to expand findings, 29 threats identified across the full platform design
Select any card to expand. Data sourced from THREAT_MODEL_STRIDE.md

Attack path analysis

Full decomposition in ATTACK_TREE_AI_PIPELINE.md

Kill chain walkthrough

Step through the highest-probability attack path. Select each phase to see detection status and control gaps.
▼
▼
▼
▼
▼
▼
Blast radius:
16 service integrations compromised, Database access (PostgreSQL), Cloud infrastructure (CDN, DNS), Communication channels (messaging, email), Code repositories, Knowledge bases

Risk acceptances

Every senior engineering decision is a tradeoff. These are mine, in writing, with compensating controls.
POAM-P17-07 / Cost tradeoff
Deferred Lakera Guard.
NeMo Guardrails plus a custom pre-graph PII scanner cover the same input rails the commercial add-on would. The gap and its revisit gate are documented for the next budget cycle.
POAM-P17-15 / Throughput tradeoff
Sequenced red-team cycles under API quotas.
Parallel runs hit provider rate limits, and the local fallback was not reached on that run. The agent sits on the sealed segment with the local model, which is the route that answers when the provider throttles. Classified as an availability failure rather than an integrity failure, and the cycles completed sequenced.
POAM-001, 002, 004, 006 / Container privilege
Accepted root in 5 vendor containers.
Compensating controls: no-new-privileges, cap_drop: ALL plus explicit minimum cap_add, AppArmor profiles, and Falco eBPF syscall tracing on every container.
POAM-007 / Host audit coverage
Falco eBPF instead of auditd.
One kernel-level detector, not two overlapping ones. eBPF covers the same syscall surface auditd would at a fraction of the overhead, with disk monitoring alerting at an 80% threshold.
POAM-P17-13 / RAG Trust Surface
External enrichment treated as hostile input.
A poisoned index entry could inject directives at the enrichment merge point. Critique-consistency check is the sole behavioral override. Attack tree leaf A.3.a is the poisoned-entry path itself, and the assessment rates it medium on the strength of that single override.

Control framework mapping

How each framework maps to STRIDE threat categories
S
T
R
I
D
E
NIST 800-53
OWASP LLM
MITRE ATLAS
NIST AI RMF
ISO 42001
CIS Benchmark
Full coverage Partial Not applicable

Identity and access

four privilege tiers, every credential named with its lifetimeOpen full viewClick a box for what it is, the controls it holds, and the file that proves it.
PrincipalDecision pointResourceIf the credential is stolen Tier 0 break-glass static key, source-restricted, last resort, no broker in the path allowlisted source host sshd Ed25519 key, static root path, no broker host shell whole host, from one source rangeFalco sees the session after the fact Tier 1 operator humans, three realm roles: admin, operator, auditor operator Access Keycloak email one-time PIN or the identity provider, 24h session OIDC code with PKCE, lockout on failed logins identity checked before origin admin consoles operator Teleport local user, TOTP, sessions recorded elevation by request, ends at 4h host SSH consoles until the 24h session endsSSH recorded, elevation ends at 4h Tier 2 service machines trade one bootstrap secret for a short-lived credential n8n and services Vault DB engine service token to the engine dynamic creds, 1h lease Postgres CI runner OIDC exchange signed JWT, main branch only minutes-lived token, read-only cloud API Telegram Access bypass published egress ranges only chat ID checked, rate limited one webhook path one database, for one hourno stored cloud key exists to leak Tier 3 agent six agent roles in the realm, five-minute tokens, screened on the way out alert source webhook token shared-secret header, rotated typed payload, schema checked Squire Squire Guardrails no model key in the agent API key held here, spend cap Claude API Squire actions allowlist typed actions, deny by default webhook token, one chat ID Telegram notify an injection reaches the allowlist,not the operator or cloud planes break-glass, static key human session, MFA machine identity, short-lived agent path, screened external service
Humanone-time PIN or OIDC → consoles, 24h. TOTP → recorded SSH, elevation by request ends at 4h
Machinedatabase engine → 1h lease. signed JWT from main → minutes, read-only. no stored cloud key
Agentsecret header in → rails → key held by guardrails → allowlist out, one chat ID
Break-glassone source range, one key, whole host, watched after the fact

Reference design. Live, partial, or planned status per control is in the POA&M.

More: agent blast radius, application security, threat model library

Agent blast radius

Select any skill node to expand abuse scenarios and control mappings
Claude Fable 5, agentic gateway
Autonomous AI agent with 6 tool-use skills, Telegram-facing, baseline assessed with no human-in-the-loop; HITL gates added after this review
Compound risk: One compromised prompt reaches every tool the agent can call, and every tool reaches the integrations behind it, so the surface multiplies with each skill added.

Application security

Vulnerability research, secure SDLC, code review, and IAM governance. Select any card for full documentation.
CI/CD Security Pipeline
PR → fmt → validate → Checkov → OPA fixture self-test → PR comment 4 gates, credential-free
Merge → Gitleaks → Trivy → Semgrep → Cosign signature check → SBOM → POA&M sync 5 gates, 1 advisory
SOAR Credential Exposure
Vulnerability assessment
CVSS 8.1 High CWE-200
44 secrets exposed via process.env. Manual discovery. Remediated same day.
AC-6 OWASP A01 Remediated
View on GitHub →
CI/CD Security Pipeline
Secure SDLC
4 PR gates 5 merge gates
Gitleaks, Trivy, Semgrep, Checkov, OPA, Cosign signature check, SBOM. 8 Rego policies.
SA-11 SA-15 CM-3
View on GitHub →
Manual Security Assessment
Code review
1 High 3 Medium 1 Low
5 findings from manual infrastructure code review. Logic flaws no scanner catches.
SA-11 CM-4
View on GitHub →
Dynamic Application Security Testing
DAST methodology
OWASP ZAP Testing Guide v4.2
Zero exposed application ports. All traffic through Cloudflare Tunnel, with one source-restricted SSH rule kept for break-glass. Quarterly assessment cadence.
RA-5 CA-8
View on GitHub →
Google Cloud IAM Governance
Cloud IAM assessment
OAuth 2.0 7 APIs Org Policy
Least-privilege IAM, credential lifecycle, cross-domain identity federation, org policy governance.
AC-2 AC-6 IA-2
View on GitHub →
OWASP Top 10 (2025)
A01: Broken Access Control✓
A02: Security Misconfiguration✓
A03: Supply Chain Failures✓
A04: Cryptographic Failures✓
A05: Injection✓
A06: Insecure Design✓
A07: Auth Failures✓
A08: Data Integrity Failures✓
A09: Logging & Alerting✓
A10: Exceptional Conditions✓

Threat model library

Each model targets a system I deployed and covers the attack surface those agents created.
STRIDE / Full platform
Platform STRIDE Threat Model
Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege across the full platform design. 29 categorized threats, 8 trust boundaries.
View on GitHub →
AI Catalog / OWASP LLM + MITRE ATLAS
AI Threat Catalog
10 AI-specific threats mapped to OWASP Top 10 for LLM Applications (2026), MITRE ATLAS v4, NIST AI RMF, and ISO 42001 Annex A.
View on GitHub →
Attack Tree / AI Inference Pipeline
AI Pipeline Attack Tree
Root goal: compromise the AI inference pipeline. 7 paths total (4 base plus 3 Squire-specific roots added in Phase 17).
View on GitHub →
Agent-Specific / I built the surface
Squire Autonomous SOC Analyst
Threat model for the autonomous SOC analyst I deployed. LangGraph agent with pgvector RAG, NeMo Guardrails sidecar, critique-consistency override, and human-in-the-loop gates on destructive actions.
View on GitHub →
Data Flow Diagram / DFD Levels 0-2
Data Flow Diagram
40 data flows cataloged across 8 trust boundaries. Sensitive data mapping, encryption coverage, and DFD-to-STRIDE crosswalk.
View on GitHub →
Red Team Results / Receipts
Red Team Cycle 1 + 2
20 red team cases across prompt injection, role hijack, PII exfiltration, and severity flip. Zero true bypasses after remediation: the one cycle 1 miss, an SSN that passed the NeMo rail, was closed the same day by the pre-graph scanner. P17-01 through P17-06 are closed with regression tests in CI; P17-07 through P17-15 are open residuals on the POA&M.
View on GitHub →

Also in the library: AI Supply Chain Risk Assessment and the AI Incident Response Playbook. View the full GRC library on GitHub →

AI security and governance

One AI governance policy covers the five AI systems in the inventory. Each has a risk profile, prompt injection defenses, and behavioral monitoring on record. The trust view draws every crossing out of the host and what stands in front of it.

ISO 42001

AI Management System

AI system inventory, risk classification, responsible AI principles, lifecycle management, human oversight requirements, and continuous monitoring controls.

View policy on GitHub →

ISO 27701

Privacy Information Management

Data protection in AI pipelines, PII handling controls, consent management, data retention policies, privacy impact assessments for AI systems.

NIST AI RMF

AI Risk Management Framework

Govern, Map, Measure, Manage functions applied to the five registered AI systems. Risk tiering, bias evaluation, performance monitoring, and incident response procedures.

AI trust

five models, one search API, three trust levels; every crossing out of the host drawn with what stands in front of itOpen full viewClick a box for what it is, the controls it holds, and the file that proves it.
Vendor models, outside the host frontier reasoning and classification, embeddings, search; DPA on file for the model and embeddings vendors, terms of service for search Trusted vendor, untrusted network path net-core, guardrails in front of the model calls on host, screened, traced; PII model baked into the image, offline enforced, cannot fetch at runtime net-ai, sealed segment local models for anything that touches raw personal data; reached only over the bridge On host, no route out Host boundary five crossings out, each one drawn Sealed boundary audio never comes back up; only text does prompt up, completion down completion fallback when the cap trips text up, vectors down vectors, DC-4 terms up, results down audio, never leaves text only orange box: data leaves here AI path, screened first fallback, sealed segment human path, closes the loop data at rest, on host trust boundary frontier modelthree reasoning nodes classifierone structured call embeddings1024-dim vectors web searchenrich node only alert payloadDC-1, attacker text token, schemashared secret, typed PII scrubregex before the graph input railNER PII, second pass model egressdaily cap, traced embedchunks, alert queries enrichIoCs and rule name voice noteoperator audio in operatorreads, decides, acts notifychat ID checked human gateHIGH and CRITICAL wait allowlistrecommend only output checksPII, citations, verbs vector storebridge-only Postgres transcripttext out, audio stays local LLMno internet route speech to textno internet route LLM02 LLM01, ASI01 LLM06 LLM10, LLM07 LLM03, ASI02 LLM03, ASI09 LLM09, ASI06
Screenedregex and NER PII before the model; citation guard and verb rewrite after; daily spend cap; every call traced; tags are the OWASP Top 10 for LLM Applications 2026 (LLM) and for Agentic Applications 2026 (ASI)
Crossingsprompt, alert queries, chunks, search terms, notification go out; audio never does; DPA for the model and embeddings vendors, terms of service for search
Humannothing acts on its own; HIGH and CRITICAL wait for a person; the operator closes the loop
Sealedraw personal data stays on a segment with no internet route; the fallback keeps working with the vendor gone

One Falco rule, explained

detections/falco/n8n-outbound.yaml Production rule 
- rule: Unexpected outbound connection from n8n
  desc: Detects n8n container making connections to non-whitelisted IPs
  condition: >
    is_n8n_container and
    evt.type in (connect) and
    fd.typechar = "4" and
    not fd.rip in (rfc_1918_addresses)
  output: >
    Suspicious outbound connection from n8n
    (connection=%fd.name container=%container.name image=%container.image.repository)
  priority: WARNING
  tags: [network, n8n, lateral_movement]
Rule breakdown
condition Scopes the rule to the svc-automation container only. Prevents false positives from other services. Monitors connect() syscalls caught by Falco eBPF.
fd.typechar Filters for IPv4 connections only ("4"). Combined with not fd.rip in rfc_1918_addresses. Any connection leaving the private network space triggers the alert.
output Structured output captures connection tuple, container name, and image. Shipped through Falcosidekick to SIEM dashboards and Telegram alerts for real-time SOC visibility.
tags Tagged lateral_movement. Aligns with MITRE ATT&CK T1571 (Non-Standard Port) and T1041 (Exfiltration Over C2). Enables automated SIEM correlation.

Should this AI system ship?

Does the AI system process, store, or have access to personal data (PII)?

Governance, Risk, and Compliance

Control layers

seven barrier layers on one hardened host, moderate baselineOpen full viewClick a box for what it is, the controls it holds, and the file that proves it.
Layer Barrier NIST 800-53 Rev 5 140 controls cited Edge who reaches the origin 0 origin addresses in DNS Access login before origin WAF custom and managed DDoS absorbed off-host rate limits per IP, webhook path DNS proxy no origin address SC-7 SC-5 AC-3 SC-8 Host what listens on the host 1 inbound port, SSH only outbound tunnel no inbound listener loopback binds no interface exposed break-glass SSH allowlisted, keys CIS baseline exceptions on record no-new-privileges 18 of 19 services resource limits CPU, memory, PIDs SC-7 CM-6 CM-7 AC-6 SC-6 Runtime what a container can reach 3 networks, one sealed, no route out Falco eBPF below the workloads three networks core, ai, monitoring sealed net-ai no internet route read-only root tunnel, alert router digest pinning Renovate tiers alerts off-host shipped to the SIEM AC-4 SC-7 SI-3 SI-4 SI-7 CM-8 IR-4 Application what the agent may do 9 layers, WAF to audit trail input rails PII and injection output rails policy, schema check actions allowlist deny by default spend ceiling per alert, daily cap Langfuse trace every call recorded webhook token shared secret HITL review high and critical SI-10 SI-4 AC-3 AU-2 AU-12 SA-8 Identity who, with what, how long 4h JIT elevation, then expiry Keycloak OIDC realm roles, RBAC Teleport MFA TOTP, every session JIT elevation approved, expires session recording to SIEM over mTLS Vault DB engine 1h lease creds lockout policy failed logins alert IA-2 IA-2(1) AC-2 AC-12 IA-5 SC-12 AC-7 Data where state lives 30d retention rule on backups Postgres bridge-only, no port CMK encryption state and backups object storage state versioned nightly backup instance principal timed restore monthly, logged SC-28 SC-12 SC-13 CP-6 CP-9 CP-10 CP-4 Delivery how change arrives 8 gates, 4 deny, 4 warn pull request only path to change OIDC exchange short-lived token scanners CVE, SAST, secrets OPA gates 4 deny, 4 warn Cosign verify upstream images human review required to merge nightly drift re-plan, diff alerts CM-3 CM-5 CM-4 SA-11 RA-5 SI-7 CA-7
Outside inedge identity → WAF → tunnel dialed out → loopback, nothing listens publicly
Insidethree networks, one sealed, kernel sensor below the workloads, 18 of 19 no-new-privileges
Agentrails → allowlist → spend cap → trace, blast radius is the allowlist
ChangePR → OIDC → Trivy, Semgrep, Gitleaks → 8 gates → review → apply, drift re-plans nightly
57 Documents
28,000+ lines of compliance documentation

Control status

0%
Implemented or inherited
103 of the 140 SSP control rows are Implemented or Inherited. 24 are Partial, 3 Planned, 10 Not Applicable. The register is the source of every one of those numbers.

NIST 800-53 status by family

AC
Access Control
AU
Audit & Accountability
IA
Identification & Auth
IR
Incident Response
CM
Config Management
RA
Risk Assessment
SC
System & Comms
SI
System & Info Integrity
CA
Assessment & Authorization
CP
Contingency Planning
SA
System & Services Acq
PL
Planning
PE
Physical & Environmental
PS
Personnel Security
MP
Media Protection
MA
Maintenance
SR
Supply Chain Risk
High (>80%) Medium (40 to 80%) Low (<40%)
Self-assessed against NIST SP 800-53 Rev 5 Moderate baseline
▶ View the GRC library on GitHub →

What is in the library

System Security Plan (SSP)
NIST 800-53, 140 controls, 17 families
View on GitHub →
POA&M + Risk Assessment
42 findings, 17 threats, MITRE ATT&CK mapped
View on GitHub →
10 Security Policies
Including AI Governance (ISO 42001 + 27701 + NIST AI RMF)
View on GitHub →
5 IR Playbooks + 2 Tabletop Exercises
Compromised container, DDoS, leaked credential, unauthorized access, AI system compromise
View on GitHub →
8 OPA/Rego Policies
Infrastructure enforcement, conftest on every PR
View on GitHub →
Threat Modeling Suite
STRIDE (29 threats, 8 trust boundaries), AI Threat Catalog, Attack trees, Squire threat model
View on GitHub →
AI Governance Engineering
Agent signing, AI audit trail spec, Supply chain register, OWASP MCP Top 10 audit, HITL policy
View on GitHub →
Red Team + Pen Test Results
20 test cases across OWASP LLM01, LLM02, LLM03, LLM07 (2026 IDs), zero true bypasses, pen test self-assessment
View on GitHub →

When a container is compromised

▼
▼
Yes, isolate
No, assess
▼
▼
▼
Select any node to expand details

Authorization boundary

what is inside the boundary, what the providers carry, and every crossing with its controlOpen full viewClick a box for what it is, the controls it holds, and the file that proves it.
Authorization boundary one hardened host, 19 services, three Terraform modules, the configuration that changes them; Moderate baseline, 140 controls cited in the SSP Configuration items versioned here CM-2 CM-3 executed by the providers edge policy Access, WAF, tokens workflows 14 definitions, pinned policy gates 8 OPA, 4 deny, 4 warn drift check nightly re-plan, alerts Host one hardened VM, published to loopback only, three segments tunnel connector host network, read-only root; dials out, listens on nothing public host sshd net-core state, identity, orchestration n8n Squire Guardrails Postgres Vault Keycloak Teleport event shipper Langfuse web Langfuse worker ClickHouse Redis net-ai sealed Whisper Ollama no route out bridged by n8n audio never leaves net-monitoring Falco, eBPF Falcosidekick Vector Datadog agent reads the kernel below every container Runtime cloud compute, network, keys, state and backups under Terraform compute, 1 host VCN, one port object storage KMS, CMK identity domain instance identity instance identity writes backups and cannot delete them state versioned, backups on a retention rule, both under the CMK Security plane what must survive the runtime cloud, on a second provider OIDC federation evidence vault break-glass key alert on read account trail region guard evidence and backup replicas arrive one way, write-only no automatic path back; a secret read pages on-call Outside people and the front door usersbrowsers, any network edge platformAccess, WAF, tunnel operatorsworkstation, SSH, IaC Telegrambot API, on-call channel HTTPS, one-time PIN IA-2 recorded SSH, TOTP IA-2 out: tunnel, TLS SC-7 SC-8 requests ride it in configures, TLS CM-3 in: break-glass, key allowlist SC-7 MA-4 in: carve-out, IP ranges AC-3 out: notify, TLS SC-8 Inherited controls the providers carry Oracle Cloud and AWS, IaaS physical, hypervisor, backbone, resolver PE family MP-4 MP-6 SC-21 Cloudflare, edge DDoS, WAF engine, tunnel edge, DNS SC-20 SC-22 Outside external services commercial, no federal data SA-9 providers, CA-3 documented image registriesupstream images, pinned in: image pull, TLS, by digest signatures checked CM-5 SI-7 secrets managerdeploy-time injection in at deploy: TLS, env vars chmod 600, none in git IA-5 DatadogSIEM, events, logs out: TLS, agent key audit off-host AU-9 SI-4 Claude APIfrontier model out: TLS, bearer, screened from Guardrails SI-10 SA-9 embeddings APIindex and query text out: TLS, text to embed chunks and queries SA-9 web search APIenrichment out: TLS, indicator terms two nodes, skippable SA-9 GitHubrepo, runners, OIDC issuer in: signed JWT, both clouds minutes, main only IA-5 AC-6 Reading the page authorization boundary crossing point human request path agent path, screened audit, telemetry out machine identity inbound exception configures
Insideone host, 19 services, three Terraform modules, the configuration that changes them; 140 controls cited, Moderate baseline
Crossings12 drawn: direction, protocol class, control; ports and data types on the SSP copy; SA-9 providers, CA-3 links
Inheritedphysical, hypervisor, backbone, resolver, DDoS, edge DNS from the providers; six inherited SSP rows, PE family by note
Exceptionone inbound port, break-glass SSH from allowlisted sources; everything else rides a tunnel the host dials out

Certifications

Verified

ISC2 CISSP

Information Systems Security Professional
Security Architecture & Risk Management
Click to verify on Credly
In progress

AWS Security Specialty

AWS Certified Security Specialty
Cloud Security Engineering
Click to view exam details
Verified

CompTIA SecurityX

Advanced Security Practitioner (CASP+)
Enterprise Security Engineering
Click to verify on Credly
Verified

ISC2 SSCP

Systems Security Certified Practitioner
Operational Security
Click to verify on Credly
Verified

Cisco CCNA

Certified Network Associate
Enterprise Networking
Click to verify on Credly
Verified

CompTIA Security+

Security Operations Fundamentals
DoD 8140 Baseline
Click to verify on Credly
Verified

ISC2 CC

Certified in Cybersecurity
Security Foundations
Click to verify on Credly
Verified

CompTIA Network+

Networking Fundamentals
Infrastructure Foundation
Click to verify on Credly

Education

Georgia State University, Andrew Young School of Policy Studies Atlanta, GA
GPA: 3.7, Dean's List
  • Bachelor of Arts in Economics | 2026
  • Associate of Science in Business Administration | 2025

Blog

Short notes on AI security, GRC, and building things. Full feed on LinkedIn.

Post, 96K impressions
The cert cycle: why my certs alone never got me a callback
Post, 33K impressions
"What have you built?" The question that goes silent
Post, 20K impressions
The certs debate: the people getting hired stopped having it
 Read more on LinkedIn →

Contact

Preferred

etigoue@tigouetheory.com
Response time: under 24 hours

Professional networks

Emmanuel Tigoue

Current status

Open to opportunities
Location
Atlanta, GA
Open to relocation
Clearance
Eligible
Download resume