Security Architects has been securing networks and systems since 1999.

We build security products and provide professional services - from penetration testing and code audit to system hardening, incident response, and tailor-made security training.

Our heritage runs deep. Our original product, Ozone, was a host intrusion prevention system that enforced least privilege on Windows systems years before “zero trust” had a name - and its agent, kernel source included, was released free in 2004. The original website is preserved here for historical interest.

Eight components or eighty lines: two ways to keep an agent's secrets

A reader asked how our agent sandbox and secrets scheme compare to OneCLI, an open-source platform for running AI agents as a team. Fair question, and the answer is more interesting than “ours is better”, because on one axis theirs is, and checking the comparison turned up a sentence on our own product page that was not true.

What OneCLI is

A team control plane. One sandboxed agent per employee, provisioned from your identity provider, under a team policy, with shared connections, memory, scheduling, and a Slack identity each. It runs on your infrastructure. The runner is outbound-only with no inbound ports, which is the same idea our tunnel client uses to live behind NAT.

read more

Mosh through your own relay

Mosh (mobile shell) is the remote terminal for people who close the lid. Your session survives sleep, a change of wifi, a train tunnel, and a laggy link, because instead of one long TCP connection it sends small encrypted UDP datagrams and lets either end roam. If you have used it once you do not go back to a plain ssh session on a laptop.

It also does not work through tunnel products, and never has. Those products forward TCP: ngrok offers no UDP endpoint at all, and Cloudflare Tunnel carries UDP only to a device running its own client. Mosh through them connects, prints nothing, and hangs. Tailscale is the exception, because Tailscale is a network rather than a tunnel, and UDP simply routes.

read more

More

Seven ways a security control can pass while doing nothing

Ozone, two decades on: we shipped least privilege in 2004

Introducing Cone of Silence: hardened agent pods

Tens of thousands of exposed AI agents - sandboxing must be the default