About
I'm SabunMacTavish. I do hands-on security work, think like the adversary, and have little patience for ceremony. This blog covers technical security, the collision of AI and security, and running security from first principles.
The only measure that matters is whether a real attacker gets in. Everything else is a proxy, and most proxies are wrong.
Projects
- 4rthur — AI-native offensive security. Pentest and red team with proprietary AI tooling.
- u9up — Independent AI security community in Malaysia. We break it, fix it, write about it.
- SherpaSec — Volunteer-run Malaysian cybersecurity community building a sustainable ecosystem.