Ethan Troy

Notes and slide decks from [un]prompted 2026 in San Francisco, covering AI security, agentic threats, and the future of AI-powered offensive and defensive security.

Build a GRC assessment agent with the Claude Agent SDK that analyzes SSPs against NIST 800-53, FedRAMP, CMMC, and EU AI Act, generates POA&M entries, and converts documents to OSCAL format.

An AI agent is just an LLM in a loop with some tools. Let me prove it by building one from scratch — raw HTTP, zero dependencies.

Recap of the OpenAI Codex meetup at UCF Orlando. Joshua Lochner demoed Transformers.js and WebGPU running LLMs in the browser. Victor from Mux covered AI eval frameworks.

Standardized consulting playbooks break down in real-world GRC engineering. Principles scale; implementation methodology depends on context.

Trusted browser processes and encrypted traffic let session-layer attacks evade endpoint controls. This post breaks down token theft, syncjacking, and AI-agent risks, with practical defenses using passkeys, ITDR, and session-aware monitoring.

Automate cross-platform Go binary releases with GoReleaser.

At IBM TechXchange 2025, I sat in on a Docling deep dive with Peter Staar’s IBM Research team and came away convinced static documents need to die. FedRAMP agrees.

Volunteering at HackSpaceCon at Kennedy Space Center. My first conference volunteer experience and finding my people in the hacker community.