Original vxcloud writing plus your Medium archive

Your VPN is an authenticated tunnel into a flat network, and it is the most reliably exploited box you own. What NIST SP 800-207 and the CISA Maturity Model actually demand, why blast radius is the only metric that matters, and how to enforce Zero Trust across AWS, Azure, GCP and bare metal without a big-bang rewrite.

vxcloud Security Engineering

Aug 5, 2026 / 18 min read

418 63

Twelve configuration steps in risk-reduction order, with the actual config files and the test that proves each control is live: phishing-resistant MFA, scoped keys, least-privilege policy, Vault secrets, default-deny egress, SPIFFE and STRICT mTLS, WireGuard, OPA/Rego in CI, hash-chained audit and Terraform gating.

vxcloud Security Engineering

Aug 5, 2026 / 24 min read

356 48

A detailed look at how we evolved our cluster topology, scheduling strategy, and observability stack to handle multi-region growth without losing cost discipline.

Joel Wembo

Mar 12, 2026 / 12 min read

342 47

What it takes to build infrastructure agents that can observe, reason, and act safely without becoming an expensive, unreliable layer of automation theater.

Joel Wembo

Mar 8, 2026 / 15 min read

567 89