<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1">
<url>
<loc>https://forensicdatabreach.com</loc>
<lastmod>2026-11-08T19:36:20.205Z</lastmod>
<changefreq>daily</changefreq>
<priority>1</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/sections/breach-reconstruction</loc>
<lastmod>2026-10-19T19:06:27.636Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/sections/cloud-permissions</loc>
<lastmod>2026-10-01T19:45:44.443Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/sections/agent-incidents</loc>
<lastmod>2026-11-06T19:16:53.378Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/sections/misconfiguration-taxonomy</loc>
<lastmod>2026-10-26T19:32:22.098Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/sections/control-patterns</loc>
<lastmod>2026-10-07T18:55:41.420Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/sections/red-team-findings</loc>
<lastmod>2026-11-08T19:36:20.205Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/sections/features</loc>
<lastmod>2026-09-24T22:50:39.637Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/authors/amara-osei-bonsu</loc>
<lastmod>2026-11-08T19:36:20.205Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/authors/saoirse-muldoon</loc>
<lastmod>2026-11-08T19:36:20.205Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/authors/devraj-ananthakrishnan</loc>
<lastmod>2026-11-08T19:36:20.205Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/authors/tomasz-kwiatkowski</loc>
<lastmod>2026-11-08T19:36:20.205Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/bug-bounty-findings-revealing-cross-tenant-iam-boundary-failures-in-saas</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-11-08T19:36:20.205Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/assumed-breach-exercises-exposing-flat-internal-network-permissions</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-11-07T19:15:58.617Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/slack-and-teams-bot-tokens-as-persistent-attacker-footholds</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-11-06T19:16:53.378Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/llm-tool-use-agents-bypassing-authorization-through-chained-api-calls</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-11-03T19:36:20.388Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/shadow-ai-agents-deployed-without-security-team-visibility</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-11-02T19:16:37.761Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/autonomous-ai-agent-data-exfiltration-via-legitimate-api-access</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-31T20:02:03.619Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/prompt-injection-attacks-causing-unauthorized-agent-actions</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-29T19:48:49.343Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/rpa-bot-over-permissioning-and-credential-abuse-in-enterprise-deployments</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-28T18:46:22.250Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/ai-agent-permission-inheritance-from-human-principals</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-27T18:52:04.730Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/confused-deputy-vulnerabilities-in-multi-tenant-saas-architectures</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-26T19:32:22.098Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/stale-service-account-credentials-left-active-after-system-decommission</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-25T20:01:14.649Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/wildcard-and-broad-resource-scope-in-iam-policy-statements</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-23T18:06:24.574Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/permission-scope-creep-through-accumulated-role-additions</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-22T18:46:45.905Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/implicit-trust-between-internal-services-and-its-breach-consequences</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-21T18:16:57.580Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/over-permissioning-at-provisioning-time-in-enterprise-iam</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-20T19:16:26.873Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/microsoft-power-apps-portals-default-public-table-exposure</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-19T19:06:27.636Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/default-credentials-and-factory-settings-in-breached-infrastructure</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-18T17:41:12.463Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/twilio-2022-breach-and-transitive-access-through-vendor-credentials</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-16T19:26:46.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/lastpass-breach-and-encrypted-vault-exfiltration-chain</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-15T18:41:11.914Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/verkada-camera-breach-and-super-admin-credential-exposure</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-14T18:12:32.829Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/capital-one-aws-iam-ssrf-exploit-and-metadata-credential-theft</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-12T19:06:28.719Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/uber-2022-breach-and-mfa-fatigue-to-internal-tool-escalation</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-11T18:51:12.822Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/solarwinds-sunburst-and-overpermissioned-build-pipeline-access</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-10T18:55:34.383Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/okta-support-system-breach-and-tenant-token-exposure</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-09T18:35:06.974Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/audit-log-design-patterns-that-would-have-detected-historical-breaches-earlier</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-07T18:55:41.420Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/blast-radius-containment-through-resource-level-iam-scoping</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-06T17:44:59.004Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/least-privilege-enforcement-for-ai-agents-at-runtime</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-05T18:50:35.893Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/zero-standing-privileges-for-service-accounts-in-cloud-workloads</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-04T18:24:48.894Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/just-in-time-access-as-a-control-derived-from-privilege-escalation-incidents</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-03T19:45:08.208Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/policy-as-code-for-authorization-as-a-breach-prevention-control</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-02T20:00:42.284Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/terraform-state-file-exposure-and-cloud-credential-harvesting</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-10-01T19:45:44.443Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/microsoft-365-permission-failures-enabling-email-and-sharepoint-exfiltration</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-09-30T19:36:11.322Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/s3-bucket-public-access-misconfigurations-across-disclosed-incidents</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-09-30T17:21:27.824Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/api-key-sprawl-in-saas-platforms-and-its-role-in-breaches</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1460925895917-afdab827c52f?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-09-30T16:20:59.207Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/aws-iam-role-chaining-and-privilege-escalation-paths-in-production</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1454165804606-c3d57bc86b40?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-09-29T06:36:29.362Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/oauth-scope-over-grant-in-third-party-saas-integrations</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-09-27T01:50:32.471Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/ci-cd-pipeline-iam-permissions-and-supply-chain-breach-exposure</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1553877522-43269d4ea984?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-09-26T05:40:43.093Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/gcp-service-account-key-misuse-in-publicly-disclosed-compromises</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-09-25T01:10:26.844Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://forensicdatabreach.com/posts/why-iac-scanners-miss-the-default-credential-problem</loc>
<image:image>
<image:loc>https://images.unsplash.com/photo-1486406146926-c627a92ad1ab?auto=format&amp;fit=crop&amp;w=1200&amp;q=70</image:loc>
</image:image>
<lastmod>2026-09-24T22:50:39.637Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
</urlset>
