Projects · Case studies

Architecture case studies, honestly labeled.

Professional engagements are sanitized to protect client confidentiality; reference designs are synthetic. Every item states which it is — no client names, identifiers or configurations are published.

Independent project

AI security evaluation

Independent project · AI security · Private repository

Making prompt-injection resistance measurable

An end-to-end evaluation framework for testing RAG and LLM applications against prompt injection, with a structured payload taxonomy and an auditable scoring model.

Read the case study

Architecture case studies

Synthetic and sanitized designs.

Each card follows the same structure: overview, threat model, architecture decisions, validation and residual risk.

Reference architecture

Azure and Microsoft 365 Zero Trust Architecture

A synthetic reference design for a regulated organization moving from network-perimeter trust to identity- and device-based access.

Entra ID · Conditional Access · Privileged identity controls · Endpoint compliance · Data protection · Monitoring and response

Threat model: Credential phishing, token theft, privilege escalation and data exfiltration from unmanaged devices.
Key decisions: Require compliant device for sensitive apps; Just-in-time admin roles with approval; Session controls for unmanaged access.
Validation: Report-only rollout, sign-in log analysis and simulated risky sign-ins.
Residual risk: Session token replay on compliant devices remains; mitigated by token protection where supported and detection.

Sanitized case study

Microsoft Sentinel Security Operations

Detection and response patterns drawn from regulated banking work, described without client-specific detail.

Log source architecture · Ingestion and retention · Detection logic · Incident investigation · SOAR playbooks · Response approval boundaries

Threat model: Compromised identities, lateral movement and slow manual triage.
Key decisions: Tier log sources by investigative value; Automate enrichment, gate containment; Document every analytic's intent and tuning.
Validation: Replay of known-bad activity and periodic false-positive review.
Residual risk: Coverage depends on log source completeness; gaps tracked as a metric.

Reference architecture

Defender for Cloud and Cloud Posture Management

A posture program built around baselines, ownership and governed exceptions.

Security baselines · Azure Policy · Workload protection · Findings prioritization · Remediation workflows · Exceptions and compensating controls

Threat model: Misconfiguration, exposed management ports and unprotected workloads.
Key decisions: Audit before deny; Route findings to resource owners; Expire exceptions automatically.
Validation: Finding age, exception age and secure score trend by subscription.
Residual risk: Business-approved exceptions carry accepted risk with named owners.

Reference architecture

Multi-cloud Security Governance

One control model expressed across Azure, AWS and Google Cloud.

Azure, AWS and GCP control concepts · Identity and access management · Key management · Network exposure · Logging and monitoring · Shared responsibility

Threat model: Inconsistent controls, orphaned accounts and unlogged environments.
Key decisions: Control objectives defined once; Provider-specific implementation guides; Central log destination.
Validation: Control matrix evidence collected per provider.
Residual risk: Provider feature gaps documented with compensating controls.

Continue to AI security research