Tamnoon / Authors
Adi Milner.
Head of Engineering
Adi leads engineering at Tamnoon, building the automation, AI agents, and pipelines that turn alerts into production-safe fixes. She writes about DevSecOps, security automation, and the practical limits of AI in remediation.
LinkedInArticles by Adi (44)
Codifying Security Policy for Terraform Prevents Cloud Misconfigurations
Security misconfigurations remain a leading cause of cloud breaches. Implementing policy as code with Terraform helps catch these issues before they deploy to production, reducing risk and operational…
Read story
Production Impact of Inconsistent Policies in CI/CD Pipelines
When security policies aren't automated and enforced across CI/CD pipelines, production environments inherit vulnerabilities that are costly to fix. Manual security checks simply can't keep pace with …
Read story
Preventing GitHub Actions Secrets Exposure
Secrets leaking from GitHub Actions pipelines present a direct route for attackers to compromise cloud environments, escalate privileges, and exfiltrate sensitive data. An exposed API key, database cr…
Read story
Conquering Cloud Alert Fatigue with Actionable DevSecOps
Cloud security alert fatigue isn't just an annoyance. It's a critical operational risk that blinds teams to actual threats. Security tools are excellent at identifying potential issues, but the sheer …
Read story
Automating Patching Without Breaking Cloud Production
Security patching in cloud environments often feels like a high-stakes surgical procedure. You know it needs doing, but the risk of collateral damage makes everyone hesitant. The challenge isn't just …
Read story
Alert Overload Resolution with Remediation Playbooks
Security Operations Centers (SOCs) face a deluge of alerts daily, creating significant pressure and often leading to burnout among analysts. Many organizations find themselves with security detection …
Read story
Slash MTTR in Cloud Security Operations with Proactive RemOps Strategies
Security teams receive a constant deluge of alerts from cloud environments, often struggling to translate these detections into meaningful, production-safe remediation at speed. The core challenge isn…
Read story
Taming Security Alerts for Cloud Security Operations
Alert fatigue kills SOC productivity and leaves organizations vulnerable. Security tools generate an overwhelming volume of alerts, many of which turn out to be false positives or low-priority issues.…
Read story
Balancing Developer Velocity With Efficient Security Remediation
Security teams often find themselves at odds with development teams. Developers need to ship code fast, but security requires thorough checks and timely fixes. This tension creates a remediation gap, …
Read story
RemOps Ends SOC Alert Overload
SOC teams are drowning in alerts. The sheer volume makes it impossible to distinguish between critical threats and benign noise, leading directly to alert fatigue and missed remediations. Traditional …
Read story
Automated Fix Playbooks for Cloud Vulnerabilities Streamline Security Operations
Security teams drown in vulnerability alerts generated by modern cloud security posture management (CSPM) and cloud-native application protection platforms (CNAPP) tools. These tools excel at detectin…
Read story
When DevSecOps Collaboration Breaks Remediation Flows
Security and DevOps often feel like two different planets, orbiting the same application but with vastly different priorities. This disconnect creates a chasm in the remediation pipeline, where vulner…
Read story
Mitigating Shadow AI Unseen Risks With Practical Governance and Remediation
Shadow AI poses tangible security risks, often operating undetected within enterprise environments. Ignoring it isn't an option. It's a direct path to data exposure and compliance failures. Organizati…
Read story
Automate Past Cloud Security Staff Shortages
The cybersecurity talent gap is a persistent operational drain. Organizations are struggling to find and retain skilled professionals capable of managing complex cloud environments. This isn't just ab…
Read story
Automating Cloud Vulnerability Remediation for Operational Stability
Cloud environments produce an overwhelming volume of security alerts, often paralyzing teams with what feels like an endless list of vulnerabilities. The real challenge is fixing them quickly and safe…
Read story
Cloud Security Incident Resolution: Lowering MTTR Is Critical
Reacting to cloud security incidents often feels like a constant race against the clock. Every minute an exposure remains unfixed translates directly into increased risk and potential operational disr…
Read story
Seamless Cloud Fixes Safely Remediate Misconfigurations and Protect Production
Security teams often find themselves in an endless cycle of identifying misconfigurations, only to see them persist in production environments. Cloud environments evolve at a rapid pace. This means co…
Read story
Taming Your NVD CVE Backlog with Strategic Risk Prioritization
The National Vulnerability Database (NVD) is struggling to keep pace. NIST enriched roughly 42,000 CVEs in 2025, but submissions are running about a third higher year-over-year in early 2026. This cre…
Read story
Preventing Secrets Exposure in GitHub Repositories
Secrets exposure in source code repositories remains a critical vulnerability. Even well-resourced agencies like CISA aren't immune. Their 'Private-CISA' GitHub repository publicly exposed credentials…
Read story
DevSecOps Teams Conquer Alert Fatigue With Smarter Solutions
Security teams drown in alerts. This isn't news, but the scale of the problem is escalating. Organizations now receive over 500,000 alerts, with 95-98% being non-critical or false positives, according…
Read story
Understanding Blast Radius in Cloud Security Remediation
A CNAPP flags an issue, the suggested fix seems simple, yet the team hesitates because they don't know what else that change might touch. This hesitation has a name: unknown blast radius. Addressing t…
Read story
Cloud Incident Remediation Playbooks Drive Swift Action
Security teams drown in alerts, not because detection tools fail, but because remediation struggles to keep pace. It's not enough to find vulnerabilities. The real challenge lies in fixing them effect…
Read story
Establishing an Impervious Cloud Security Configuration Baseline
Unsecured cloud configurations are a leading cause of breaches, not just detected vulnerabilities. Organizations often invest heavily in detection tools like Wiz, Orca Security, and Palo Alto Cortex C…
Read story
Beyond Alerts Mastering Automated Remediation in Cloud Security
Security teams drown in alerts. A critical operational reality is that a typical enterprise cloud environment generates thousands, if not tens of thousands, of security findings daily. Cloud Security …
Read story
Securing AI Agents in CI/CD Preventing Software Supply Chain Exploits
Securing AI Agents in CI/CD Preventing Software Supply Chain Exploits The integration of AI agents into CI/CD pipelines significantly changes the software delivery landscape. We're well beyond simple …
Read story
Cloud Security Misconfiguration Playbooks Actionable Remediation
Cloud Security Misconfiguration Playbooks Actionable Remediation Your CSPM is lit up, but your attack surface isn't shrinking. This is the core disconnect in modern cloud security. Detection without a…
Read story
Continuous Automated Compliance Prevents DevSecOps Production Breakage
Security and operational resilience hinge on continuous compliance. Ignoring it creates significant technical debt, making production environments fragile and susceptible to violations, configuration …
Read story
Fortify DevSecOps Pipelines Eliminate Cloud Misconfigurations Effortlessly
Cloud misconfigurations are still a leading cause of breaches. We've seen it play out repeatedly. The move to DevSecOps is supposed to shift security left, baking it into the pipeline, but often it ju…
Read story
Shrink Your Vulnerability Backlog Take Action Now
Shrink Your Vulnerability Backlog Take Action Now Dealing with a sprawling vulnerability backlog feels like trying to empty the ocean with a thimble. Most security teams are drowning in alerts, strugg…
Read story
Securing AI Agents Mastering Runtime Authorization
The Imperative for Runtime Authorization in AI Agents AI agents are here, and they're not just hypothetical anymore. Gartner projects that 40% of enterprise applications will embed task-specific AI ag…
Read story
Cloud Open-Source Supply Chain Remediation for DevSecOps
Cloud Open-Source Supply Chain Remediation for DevSecOps Your Software Composition Analysis (SCA) tool is working perfectly, but your attack surface isn't shrinking. Every day, scanners from Wiz, Pris…
Read story
Alert Noise Drowning Your SOC: Strategies for Meaningful Cloud Security Responses
Your SOC's Alert Count Is a Liability, Not a KPI The number of alerts your CNAPP or SIEM generates is an indicator of tool configuration, not security posture. Security teams are overwhelmed, with org…
Read story
Automated Secret Rotation: Fortifying Cloud Environments in DevSecOps
Automated Secret Rotation: Fortifying Cloud Environments in DevSecOpsFlipping the switch on automated secret rotation for a production database is a high-stakes bet.While every security framework from…
Read story
Closing the Cloud Security Gap: From Detection to Production-Safe Remediation
Your Cloud Has 10,000 Alerts, and Most of Them Don't Matter Right Now Your CNAPP dashboard is lit up like a Christmas tree. Wiz, Orca, or Prisma Cloud just dumped thousands of alerts into your queue. …
Read story
Alert Overload to Operational Control: Automating Remediation Reclaims SOC Focus
Your SOC is drowning in alerts it can't act on. The volume isn't the problem; it's the signal-to-noise ratio. Security teams are flooded with notifications from their Cloud Native Application Protecti…
Read story
Automated Exposure Management: Picking the Right Enterprise Platform
Automated Exposure Management: Picking the Right Enterprise Platform Your CNAPP is generating thousands of alerts, but your risk posture isn't improving. This is the operational reality for many secur…
Read story
Shrinking Your Cloud Vulnerability MTTR: Actionable Fix-Strategies
Your Detection Tools Are Alert-Rich but Fix-Poor Your cloud security stack is likely exceptional at finding problems. Tools from Wiz, Prisma Cloud, and Orca Security generate thousands of alerts, duti…
Read story
Agentic AI is Your Newest Attack Surface: Stop LLM Data Leaks
Your Agent's IAM Role Is the New Attack Perimeter Your AI agent's IAM role is a bigger security liability than a publicly exposed S3 bucket. A single over-privileged, long-lived credential attached to…
Read story
DevSecOps Strategies for Proactive npm Malware Protection
DevSecOps Strategies for Proactive npm Malware ProtectionYour npm install is a loaded gun pointed at your production environment. With a developer ecosystem that pulls in millions of open-source packa…
Read story
Closing the Cloud Security Gap: Stop Scanning and Start Fixing
Your Cloud Scanner Is a To-Do List Nobody Is Finishing The daily report from your CSPM lands in your inbox: thousands of alerts, hundreds marked “critical.” Your Wiz, Prisma, or Orca dashboards are a …
Read story
Automated Remediation Breaks Production: Managing Playbook Risk in Complex Environments
Your Auto-Remediation Playbook Just Took Down Production An automated security playbook just took an action your Cloud Security Posture Management (CSPM) tool recommended. The alert is green, the dash…
Read story
12 Critical DevSecOps Best Practices to Stop Malware in 2026
12 Critical DevSecOps Best Practices to Stop Malware in 2026Your CI/CD pipeline is the new front line for malware delivery.With threat actors publishing over 512,000 malicious open-source packages in …
Read story
LLM Agent Exploit Patterns: Defending the New Attack Surface
Your Cloud Security Tools Don't Understand Your LLM Agents LLM agents aren't just another workload; they're autonomous entities with cloud credentials. We're connecting them to our most sensitive data…
Read story
Adversarial AI Exploits: Why Your 'Smart' LLM is About to Rob You Blind
Your LLM's Biggest Vulnerability Isn't the Algorithm, It's the IAM Role The operational risk of deploying Large Language Models (LLMs) isn't confined to the probabilistic nature of the model itself. T…
Read story