Brian Baldock

Creating Identity for agentic AI Learn best practices for secure identity management in agentic AI systems, ensuring accountability and zero trust in dynamic, scalable environments

ICYMI: My latest post on identity design for AI agents is still fresh.
OBO flow vs service creds, secrets, and audit trails, all covered.
Still relevant. Still useful.
blog.brianbaldock.net/recipe-desig...
#CyberSecurity #AgenticAI

Creating Identity for agentic AI Learn best practices for secure identity management in agentic AI systems, ensuring accountability and zero trust in dynamic, scalable environments

New post: Designing Identity for Agentic AI.
How do agents securely access systems like SQL Server?
I break down two flows (OBO + service creds) + give you a practical checklist.
Check it out 👉 blog.brianbaldock.net/recipe-desig...
#ZeroTrust #AIIdentity

Last week I shared what breaking into my own systems taught me as a defender. From missed file permissions to my first reverse shell—it was eye-opening.

What moment shifted your view on defense?

Catch the full post here: blog.brianbaldock.net/a-better-def...

New blog just dropped: How breaking in made me a better defender.
Offensive security taught me more than I expected; reverse shells, overlooked basics, and how fragile assumptions really are.
What changed your view on defense?
🔗 blog.brianbaldock.net/a-better-def...

Push fatigue + phishing = breach.
Learn how to upgrade your MFA game with phishing-resistant options that actually work.
blog.brianbaldock.net/mfa-beyond-p...
#ZeroTrust #MFA #CyberSecurity

Tap-to-approve MFA isn’t good enough.
Read how real breaches happen—and how to prevent them.
blog.brianbaldock.net/mfa-beyond-p...
#CyberSec #Microsoft365 #Identity

Air-gapped networks aren’t as secure as many think. Stuxnet proved that. Insider threats prove that. Meanwhile, HTTPS/TLS provides a controlled, encrypted tunnel—similar to a VPN. It’s time to rethink our approach to security.

Read more in my latest blog post: buff.ly/4hDd9dU
#CyberSecurity #VPN

Went live with @Merrill last week to break down the new Conditional Access deployment guide + setup.cloud.microsoft. Super slick way to deploy CA right. 🔐

Catch the replay here: www.linkedin.com/events/entra...
#EntraID #Microsoft365 #Security

Leave A Gripe LeaveA.gripe is an interactive art project and safe haven for sharing unfiltered truths, gripes, and opinions. In a world of disinformation, media overload, algorithmic control, and surveillance capitalism, we offer a space for genuine, unmediated expression.

A place where words are the only thing that matters.

No accounts. No tracking. No judgment. Just sticky notes floating forever.

Welcome to LeaveA.Gripe

Disconnected Environments Revisited Why Proxies Remain Essential for Defender for Endpoint in 2025

💭 Do you trust Microsoft with your emails and files? Then why not security?
Defender for Endpoint’s cloud intelligence is just as safe—and more critical than ever. Proxies aren’t the problem—they’re the solution. Here’s how to enable Defender securely in 2025:

Disconnected Environments Revisited Why Proxies Remain Essential for Defender for Endpoint in 2025

🔐 Disconnected doesn’t have to mean unprotected.
With streamlined allow-listing, Defender for Endpoint can work seamlessly in restricted networks—but proxies are still a must. Learn how to do it securely: blog.brianbaldock.net/mde-proxies-...
#MDE #Proxies #CyberSecurity

Leave A Gripe LeaveA.gripe is an interactive art project and safe haven for sharing unfiltered truths, gripes, and opinions. In a world of disinformation, media overload, algorithmic control, and surveillance capitalism, we offer a space for genuine, unmediated expression.

No filters. No replies. No moderation.

Just raw, anonymous thoughts pinned to an infinite digital board.

It’s called LeaveA.Gripe—an art project about expression without expectations.

Drop a thought: LeaveA.Gripe

Leave A Gripe LeaveA.gripe is an interactive art project and safe haven for sharing unfiltered truths, gripes, and opinions. In a world of disinformation, media overload, algorithmic control, and surveillance capitalism, we offer a space for genuine, unmediated expression.

Ever wanted to post something and not care what happens next?

Welcome to LeaveA.Gripe—an infinite pinup board for the internet. No replies, no likes, no moderation. Just words floating in the void.

Try it: LeaveA.Gripe

Disconnected Environments Revisited Why Proxies Remain Essential for Defender for Endpoint in 2025

🚀 Defender for Endpoint + Proxies = Secure Cloud Protection
Still avoiding Defender’s cloud intelligence because of a disconnected network? Proxies make it work! Here’s how to configure them securely and get full cloud-powered protection in 2025:

VPNs are widely trusted for security, but HTTPS/TLS achieves many of the same security goals—just at the application layer. If we trust VPNs, why dismiss HTTPS/TLS as “open internet”?

I break down the misconceptions in my latest post: buff.ly/4hDd9dU

#CyberSecurity #ThreatIntel #Encryption

Deploying Local AI Inference with vLLM and ChatUI in Docker Building a Self-Hosted Chatbot with an Nvidia GPU and Open-Source Tools

Self-hosting an AI chatbot? Easier than you think.
I built one with Docker, NGINX, and my RTX 3080—fast, secure, and fully local.
Here’s how: https://buff.ly/40WeBlT
#AI #SelfHosted #LLM #Docker #NGINX

No data center? No problem.
I built an AI chatbot with Docker, an RTX 3080, and NGINX—secure, fast, and fully local.
Check it out: https://buff.ly/40WeBlT
#AI #SelfHosted #LLM #Docker #NGINX

If a service like Defender for Endpoint requires an internet connection, does that mean it’s exposed? No. HTTPS/TLS encryption functions much like a VPN—restricting access to trusted services with encryption at different layers. I break this down in my latest post:

Huh what - local inference with docker? Yup.
✅ Local inference with vLLM
✅ Secured with NGINX & Certbot
✅ Fast, private, and free
Here’s how: https://buff.ly/42CUF8N
#AI #SelfHosted #Docker #LLM #APIFree

Deploying Local AI Inference with vLLM and ChatUI in Docker Building a Self-Hosted Chatbot with an Nvidia GPU and Open-Source Tools

Got a gaming PC? Turn it into an AI chatbot with Docker.
I used my RTX 3080 to self-host an LLM—no APIs, no cloud costs.
Here’s the full guide: https://buff.ly/40WeBlT
#AI #Docker #LLM #SelfHosted

Took me a while to get this setup working, but the final results are solid. If you’re into AI, Docker, or self-hosting, check it out and let me know what you’d do differently!

I'd argue that they are a global necessity.

Deploying Local AI Inference with vLLM and ChatUI in Docker Building a Self-Hosted Chatbot with an Nvidia GPU and Open-Source Tools

Just published a blog on self-hosting an AI chatbot with Docker, vLLM, ChatUI, and GPU acceleration. Covers the full setup, troubleshooting, and lessons learned.

Check it out here: https://buff.ly/40WeBlT
#AI #Docker #SelfHosting #HomeLab

Working on a new blog post, this one's a big one - lots of good details for making a full on custom inference homelab for playing with AI models, stay tuned.

It's ready, just built out a 3 node proxmox cluster running my full lab and a node specific for AI workloads. Gonna be a fun holiday! Time to try out some uncensored models.

🔒 Don’t wait for cyberattacks—stop them with Microsoft Defender XDR!

Join our webinar to see:
✅ AI-powered threat detection
✅ Live demos & Q&A

📅 Register now: https://buff.ly/4ignxZP

🚨 Stop cyberattacks with Microsoft Defender XDR!

Join our webinar to see AI-powered tools stop threats across identities, devices, and data before damage happens.

✅ Live demos
✅ Q&A
✅ Security insights

📅 Register now:

Learn about Universal Continuous Evaluation (Preview) - Global Secure Access Learn about Universal Continuous Evaluation concepts

Universal Continuous Access Evaluation (UCAE) is now in Public Preview! 🚀 Real-time access policy enforcement that adapts instantly to risks—no more waiting for token expiration. Think smarter, faster Zero Trust. Security Service Edge for the win! #UCAE #Microsoft
🔗

In 1903, Nevil Maskelyne staged the first wireless hack, disrupting John Ambrose Fleming’s demo of Guglielmo Marconi’s "secure" telegraph. He sent Morse code insults to expose its flaws, proving even the earliest wireless tech wasn’t immune to attacks. #Hackersbehacking

Set up device-based Conditional Access policies with Intune - Microsoft Intune Configure a device-based Conditional Access policy that uses device status from a Microsoft Intune device compliance policies.

MFA isn’t enough. Device compliance stops AiTM attacks by blocking untrusted devices—even if MFA is bypassed. Secure Microsoft 365 the smart way.