Writing and tools

EngSecLabs is where Alex Smolen writes about security engineering and ships open-source security tools. It started as a consulting practice. Alex now works full-time elsewhere, so the site is the blog and the projects.

Still open to the occasional project or advisory engagement. Email me at alex@engseclabs.com to say hello.

Recent writing

All writing

Tools I've built

TrailTool CloudTrail for AI agents

Pre-aggregates events into entities (people, sessions, roles, services) so agents can reason over cloud activity without blowing the context window.

iam-agent-proxy Least privilege for AWS agents

Credential isolation and least privilege for AWS agents. Hands agents fake keys, re-signs each request with real credentials, and generates a least-privilege policy from observed behavior.

GraphGRC SOC 2 compliance in GitHub

Pre-written controls and policies in Markdown with semantic linking. Your compliance docs live in version control, queryable by AI, not locked in a SaaS platform.

All tools

Alex Smolen

I'm a security engineer with over a decade of experience building and breaking security-critical systems. I've worked across application security, cloud infrastructure, AI security, and compliance at startups and high-growth companies.

I write about security engineering here and on alexsmolen.com. If you're working through a hard security problem, I'd like to hear about it.

Alex Smolen