Security that's designed in, not bolted on.
I'm JV, a security architect. This is my portfolio — where I share a business-driven, SABSA-based approach to secure-by-design, zero trust and well-architected cloud, and keep watch on the vulnerabilities shaping the field. Not a sales page — a point of view.
How I think about security
Security is a design property. I start from what the business needs to be true, and trace every decision from there: every control traces up to a business reason, and every business need traces down to evidence.
Business attributes
Agree with the business what the system must be — available, confidential, auditable — and how each is measured.
Risk
Threats and likelihood assessed against those attributes — the threat model that actually applies.
Architecture
Zero-trust, well-architected patterns that remove failure modes instead of watching for them.
Controls
Selected from NIST SP 800-53, CIS or cloud guardrails — each one traced to the risk it treats.
Evidence
Configurations, logs and tests, collected automatically and fed back to the people who own the risk.
What I focus on
Secure by Design
Threat modelling and security requirements built into architecture from day one, rather than retrofitted after a pen test.
Zero Trust Architecture
Identity-centric access, least privilege, micro-segmentation and continuous verification — never trust, always verify.
Well-Architected Cloud
Patterns aligned to the AWS and Azure Well-Architected security pillars: landing zones, guardrails and defensible defaults.
Identity & Access
Federation, conditional access, secrets and workload identity — treating identity as the real perimeter.
Governance & Frameworks
SABSA as the spine, with NIST CSF, SP 800-53, CIS, the NCSC CAF and NIS2 mapped onto it so security stays traceable and auditable.
Threat Modelling
STRIDE and attack-path analysis to surface the weaknesses that matter before an adversary does.
Latest perspectives
SABSA as the foundation: security architecture that starts with the business
Business attributes, risk and opportunity, and two-way traceability — the spine every other framework hangs off.
The CAF and NIS2: one architecture, two regulatory regimes
The NCSC Cyber Assessment Framework and the EU NIS2 Directive side by side — build once, evidence twice.
UK Secure by Design: ten principles on a SABSA spine
The UK government's mandatory policy mapped onto SABSA layers — and where it stops covering the CAF.
Threat watch
Security news
Sources: The Register, The Hacker News, Dark Reading, Krebs on Security (merged, newest first)
Actively exploited · CISA KEV
Source: CISA Known Exploited Vulnerabilities catalog (newest additions)
Latest CVE advisories
Source: GitHub Security Advisory Database (CVE / GHSA)