Ethan Troy

Security @ Cursor | Hacker @ hackIDLE

I'm often asked about what I do and I often joke that “I just click buttons.” It's how I've moved through seemingly complex problems without overcomplicating them and fundamentally I believe everything is figure-out-able if you click enough buttons.

Currently focused on

Offensive AI Security red teaming LLMs, agents, tool use, and AI application attack surfaces
Cloud & Kubernetes Security hardening cloud environments, k8 clusters, workloads, identity, and supply chain paths
Mobile, IoT & ICS security exploring device hacking, embedded systems, and industrial control environments
GRC Engineering in the Cloud building FedRAMP, machine-readable (OSCAL), and compliance automation workflows

Writing

View all →

Long-form posts on GRC engineering, AI agents, cloud security, and the tooling behind both.

Engineering Updated 13 June 2026

Building a GRC Agent with the Claude Agent SDK

Build a GRC assessment agent with the Claude Agent SDK that analyzes SSPs against NIST 800-53, FedRAMP, CMMC, and EU AI Act, generates POA&M entries, and converts documents to OSCAL format.

Engineering 8 February 2026

Build an AI Agent from Scratch (No Frameworks)

An AI agent is just an LLM in a loop with some tools. Let me prove it by building one from scratch — raw HTTP, zero dependencies.

Cybersecurity Updated 3 April 2026

The Browser Session Gap Is Still Security's Biggest Blind Spot

Trusted browser processes and encrypted traffic let session-layer attacks evade endpoint controls. This post breaks down token theft, syncjacking, and AI-agent risks, with practical defenses using passkeys, ITDR, and session-aware monitoring.

Engineering 24 January 2026

You Can Standardize Principles, Not Methodologies.

Standardized consulting playbooks break down in real-world GRC engineering. Principles scale; implementation methodology depends on context.

Media

View all →

Webinars, podcasts, and recorded talks on FedRAMP 20x, compliance automation, and security engineering.

Panels 2 April 2026

FedRAMP 20x Explained Webinar

Panel on what FedRAMP 20x actually changes for CSPs and 3PAOs, covering KSIs, automated evidence collection, and the launch of InfusionPoints’ FedRAMP 20x Cohort Program.

Interviews 12 May 2026

Paramify Podcast: GRC Engineering, FedRAMP 20x, and AI

Podcast conversation with Kenny Scott and Isaac Teuscher about GRC Engineering, FedRAMP 20x, practical AI agents, and why domain expertise still matters.

Panels 24 July 2025

FedRAMP 20x CWG: Pilot Demos

Monthly FedRAMP 20x CWG session featuring pilot demos and submissions from CSPs and 3PAOs

Events

View all →

Conferences and community events where I've presented or participated.

Events Updated 26 March 2026

[un]prompted 2026

Notes and slide decks from [un]prompted 2026 in San Francisco, covering AI security, agentic threats, and the future of AI-powered offensive and defensive security.

Events Updated 13 March 2026

OpenAI Codex Community Meetup - Orlando

Recap of the OpenAI Codex meetup at UCF Orlando. Joshua Lochner demoed Transformers.js and WebGPU running LLMs in the browser. Victor from Mux covered AI eval frameworks.

Events Updated 11 April 2026

IBM TechXchange 2025: Docling, FedRAMP, and Why Static Documents Need to Die

At IBM TechXchange 2025, I sat in on a Docling deep dive with Peter Staar’s IBM Research team and came away convinced static documents need to die. FedRAMP agrees.

Projects

View all →

Tools I build for compliance workflows, control validation, and security data pipelines.

Security Tools Updated 7 June 2026

NIST CMVP API

Static API serving NIST CMVP validated modules, historical modules, in-process modules, certificate detail records, search indexes, data quality reports, and agent-ready docs.

Security Tools WIP Updated 7 April 2026

myctrl.tools

Security controls reference with 20,600+ controls across 105+ frameworks. Interactive knowledge graph, framework comparison, crosswalk explorer, implementation guidance for 30+ technologies, and AI-composed views via json-render.

Compliance Tools WIP Updated 7 April 2026

GRCLanker

Spec-driven templates for compliance automation. 30+ vendor specs that AI coding agents consume to build working security inspectors.

Security Tools Updated 3 July 2025

FedRAMP 20x Assessment App

Built the assessment app used by Fortreum to conduct FedRAMP 20x pilot assessments for InfusionPoints.

Open Source Security & ML Contributions

View all →

Upstream contributions and open collections across security tooling and ML for compliance.

Security Tools Updated 6 April 2026

Prowler

Open-source cloud security platform for AWS, Azure, GCP, Kubernetes, and M365 - performs security assessments, compliance audits, and continuous monitoring with 900+ built-in checks across 38+ frameworks

AI/ML Tools 19 October 2025

Open Source Security Compliance AI & ML

A collection of my open source security compliance datasets, models (fine-tuned LLMs), etc.

AI/ML 20 October 2025

HackIDLE-NIST-Coder

Specialized cybersecurity AI trained on 596 NIST publications. Provides expert guidance on security frameworks, Zero Trust, FIPS cryptography, cloud security, and supply chain risk management.

Compliance Tools Updated 3 April 2026

MCP Server for OSCAL

Contributed a 4-stage OSCAL validation tool to the AWS Labs MCP server, covering JSON parsing, schema conformance, Pydantic semantic checks, and optional oscal-cli validation.

Training Labs

View all →

Hands-on Killercoda labs for container, cloud, and vulnerability management practice.

CTF Updated 7 March 2026

Damn Vulnerable Trust Center (DVTC)

An archived educational CTF platform featuring realistic security flaws in a modern trust center system. Includes Docker-based environment with Next.js frontend, FastAPI backend, and in-memory mock AWS services. Still fully runnable locally.

Cybersecurity Updated 17 December 2022

Tenable Nessus Vulnerability Management Home Lab

Hands-on vulnerability management lab using Nessus Essentials to scan a Windows VM. Covers basic vs credentialed scans, installing deprecated software to simulate real-world scenarios, and practicing vulnerability remediation workflows.

Cloud Security 28 October 2025

Introduction to Chainguard Images

Learn about Chainguard’s secure container images that are built with minimal attack surface, constantly updated with security patches, and verified with SBOM and Sigstore. Hands-on exercises cover running, inspecting, and building applications with Chainguard base images.

Recent Training

View all →

Recent certification and course reviews from paths I've completed.

Certification Reviews Updated 16 February 2026

OSCP Review & 2026 Preparation Guide

OSCP review and 2026 study guide from a first-attempt passer. PEN-200 exam breakdown, study resources, OSCP vs OSCP+ comparison, and whether the cert is still worth it.

Certification Reviews Updated 13 February 2026

SecOps Certified AI/ML Pentester (C-AI/MLPen) Review

SecOps C-AI/MLPen review: it’s a prompt injection CTF disguised as an AI/ML pentesting cert. Failed the first attempt (got rickrolled by a chatbot), passed on the second. Worth it at 70% off.

Certification Reviews Updated 17 March 2026

Google Cloud Professional Cloud Security Engineer Review (2025)

First-attempt pass on the GCP Professional Cloud Security Engineer. How red team experience carried the defensive cert, the encryption key questions that tripped me up, and why Google Cloud Skill Boost labs are the best study resource.

Certification Reviews Updated 15 March 2026

GRTE (GCP Red Team Expert) Review

My GRTE review after a first-attempt pass. What the GCP Red Team Expert course covers, how the exam works, where I got stuck, and whether it is worth the cost.

Work In Progress

View all →

Drafts and experiments in active development.

↑

Ethan Troy

Security @ Cursor | Hacker @ hackIDLE

Writing

Building a GRC Agent with the Claude Agent SDK

Build an AI Agent from Scratch (No Frameworks)

The Browser Session Gap Is Still Security's Biggest Blind Spot

You Can Standardize Principles, Not Methodologies.

Media

FedRAMP 20x Explained Webinar

Paramify Podcast: GRC Engineering, FedRAMP 20x, and AI

FedRAMP 20x CWG: Pilot Demos

Events

[un]prompted 2026

OpenAI Codex Community Meetup - Orlando

IBM TechXchange 2025: Docling, FedRAMP, and Why Static Documents Need to Die

Projects

NIST CMVP API

myctrl.tools

GRCLanker

FedRAMP 20x Assessment App

Open Source Security & ML Contributions

Prowler

Open Source Security Compliance AI & ML

HackIDLE-NIST-Coder

MCP Server for OSCAL

Training Labs

Damn Vulnerable Trust Center (DVTC)

Tenable Nessus Vulnerability Management Home Lab

Introduction to Chainguard Images

Recent Training

OSCP Review & 2026 Preparation Guide

SecOps Certified AI/ML Pentester (C-AI/MLPen) Review

Google Cloud Professional Cloud Security Engineer Review (2025)

GRTE (GCP Red Team Expert) Review

Work In Progress

WIP Lessons from an Unreluctant Manager. Everything I learned from my team.

WIP Docker Group = Root: How I Upgraded Packages Without Sudo

WIP Prompt Engineering Doesn't Matter. It Kind of Does.

Building a GRC Agent with the Claude Agent SDK

Build an AI Agent from Scratch (No Frameworks)

The Browser Session Gap Is Still Security's Biggest Blind Spot

You Can Standardize Principles, Not Methodologies.

FedRAMP 20x Explained Webinar

Paramify Podcast: GRC Engineering, FedRAMP 20x, and AI

FedRAMP 20x CWG: Pilot Demos

[un]prompted 2026

OpenAI Codex Community Meetup - Orlando

IBM TechXchange 2025: Docling, FedRAMP, and Why Static Documents Need to Die

NIST CMVP API

myctrl.tools

GRCLanker

FedRAMP 20x Assessment App

Prowler

Open Source Security Compliance AI & ML

HackIDLE-NIST-Coder

MCP Server for OSCAL

Damn Vulnerable Trust Center (DVTC)

Tenable Nessus Vulnerability Management Home Lab

Introduction to Chainguard Images ↗

OSCP Review & 2026 Preparation Guide

SecOps Certified AI/ML Pentester (C-AI/MLPen) Review

Google Cloud Professional Cloud Security Engineer Review (2025)

GRTE (GCP Red Team Expert) Review

WIP Lessons from an Unreluctant Manager. Everything I learned from my team.

WIP Docker Group = Root: How I Upgraded Packages Without Sudo

WIP Prompt Engineering Doesn't Matter. It Kind of Does.

Introduction to Chainguard Images