# PanIAM's Blog > Engineering notes, cloud security insights, and IAM deep dives from the team building PanIAM. ## Posts - [Think Outside the Pod: Kubernetes Access, From Cluster to Cloud](https://blog.paniam.cloud/posts/introducing-kubernetes.md): PanIAM now models Kubernetes access: who can act inside your clusters, what your workloads can reach in your cloud, and what a privileged pod really holds. (Published 2026-10-15.) - [Introduction to Information Theory and Why You Should Care](https://blog.paniam.cloud/posts/introduction-information-theory-care.md): A primer on Claude Shannon's information theory: entropy, mutual information, KL divergence, the data processing theorem, and why all of it matters for machine learning. (Published 2026-08-25.) - [Three Layers, One Guarantee: What Beyond Zero Actually Changes for AI Agents](https://blog.paniam.cloud/posts/three-layers-one-guarantee.md): Google's new Beyond Zero paradigm confirms what the industry has been converging on for months: an agent's instructions can't be guaranteed, but what it can actually do can be. A look at what changes once that distinction gets a name and a reference architecture, and where PanIAM already lives in it. (Published 2026-08-04.) - [Prompt and Circumstance: Who Can Prompt Your AI Agent, and Everything It Can Reach](https://blog.paniam.cloud/posts/prompt-and-circumstance.md): An AI agent is an execution role in a costume. This post walks the concrete lateral-movement paths PanIAM now detects around Bedrock and AgentCore, where 'who can prompt it' turns out to be a privilege-escalation question. (Published 2026-07-21.) - [Two Kinds of Companies: The Ones Who Know Their Employees Run AI Agents, and the Ones Who Don't](https://blog.paniam.cloud/posts/shadow-ai-govern-dont-block.md): Banning AI agents does not make shadow AI disappear, it only makes it invisible. The safer move for leaders is to offer governed agents on the cloud they already run, and to be able to answer two questions about each one. (Published 2026-07-17.) - [The AI Security Blindspot: What builders and leaders need to know before it's too late](https://blog.paniam.cloud/posts/ai-introduction.md): As someone who has built AI systems and now secures the infrastructure they run on, I want to bridge the gap between two communities that still don't speak the same language. (Published 2026-07-01.) - [Myth: "My Detection System Is Enough"](https://blog.paniam.cloud/posts/detection-is-not-enough.md): Why cloud detection arrives too late, stays blind to IAM attack paths, and leaves a window wide enough to lose everything. (Published 2026-06-24.) - [Project Glasswing and the CVE Avalanche: Why Your Cloud Blast Radius Is the New Control Plane](https://blog.paniam.cloud/posts/glasswing-cve-avalanche.md): Anthropic's Glasswing signals either a wave of public CVEs or a wave of silent zero-days. Either way, exploitation now outruns patching, and cloud blast-radius visibility is the control that still works. (Published 2026-04-28.) - [The Blueprint Inspector: How PanIAM Secures Your Cloud Without Touching Your Data](https://blog.paniam.cloud/posts/external-id.md): Over-permissioned SaaS tools are a real risk. Here's how PanIAM accesses only the configuration it needs, and how you stay in control the entire time. (Published 2026-04-13.) - [Google API Keys Are Now Secrets: How Gemini Changed the Rules](https://blog.paniam.cloud/posts/google-api-keys-are-now-secrets.md): Google API keys were never treated as secrets — until Gemini made them dangerous. Learn how a leaked key can lead to massive bills and illegal AI usage. (Published 2026-03-12.) - [The Hidden Path: Lateral Movement Through IAM Trust Policy Modification](https://blog.paniam.cloud/posts/lateral-movement-trust-policy.md): How attackers leverage UpdateAssumeRolePolicy to move laterally across AWS environments, and why traditional permission analysis often misses this vector. (Published 2026-01-20.) - [What Cybersecurity Leaders Will Do Differently in 2026](https://blog.paniam.cloud/posts/do-differently-2026.md): Cyber threats, cloud complexity, and regulation are reshaping cybersecurity. Here’s what leaders need to rethink in 2026 to stay resilient. (Published 2026-01-07.) - [Introducing Remediations: Unified Risk Prioritization for Cloud Security](https://blog.paniam.cloud/posts/vuln-remediations.md): PanIAM now analyzes both IAM policy misconfigurations and software vulnerabilities, using real-world exploit data to help security leaders prioritize fixes by actual risk reduction. (Published 2025-11-24.) - [NIS2: From Compliance to Competitive Advantage](https://blog.paniam.cloud/posts/nis2.md): Understanding NIS2, supply-chain accountability, and why proving security matters as much as having it. (Published 2025-11-12.) - [Introducing Side Panels: Navigate Cloud Permissions in Seconds](https://blog.paniam.cloud/posts/side-panel.md): Side Panels bring cloud permission details and escalation path intelligence directly into your PanIAM workflow. What took 10 minutes in your cloud console now takes 10 seconds. (Published 2025-10-16.) - [Myth: We Have Backups and Can Just Pay the Ransom — So Ransomware Isn't a Big Threat](https://blog.paniam.cloud/posts/i_can_pay_the_ransom.md): Why backups and paying the ransom no longer protect you: attackers delete backups first, steal data for double extortion, and often never restore. (Published 2025-10-02, updated 2026-10-24.) - [Introducing Secret Detection: A New Layer of Security in Your IAM & Network Graphs](https://blog.paniam.cloud/posts/introducing-secret-detection.md): PanIAM Secret Detection finds exposed AWS access keys and API tokens for services like GitHub, OpenAI and Stripe, and maps what each one can reach. (Published 2025-09-18.) - [The EU's Cyber Resilience Act: Prepare your business](https://blog.paniam.cloud/posts/cyber-resilience-act.md): Explaining the EU's Cyber Resilience Act and showing how PanIAM can help businesses prepare. (Published 2025-09-10, updated 2026-10-24.) - [Debunking the Myths: Cloud Providers Have My Back](https://blog.paniam.cloud/posts/cloud-has-my-back.md): Exploring the myth that cloud providers ensure complete data security and availability. (Published 2025-08-04.) - [Debunking the Myths: Why SMBs are Prime Targets in the Ransomware Age](https://blog.paniam.cloud/posts/why-smbs-are-prime-targets-in-the-ransomware-age.md): Exploring the specialized ransomware ecosystem and why SMBs are prime targets. Learn how to protect your business. (Published 2025-07-09, updated 2026-10-24.) ## About PanIAM - [PanIAM](https://paniam.cloud/llms.txt): What PanIAM does, how to try it and who builds it. ## Optional - [Every post in full](https://blog.paniam.cloud/llms-full.txt)