Curious?
Head of Security, Composio · Founder, Burrow
Sleeve notes
Eight years · Five companies · Bengaluru
I find the things in production that nobody wanted found, then build the controls that stop them happening twice.
Right now that means AI agents which write, commit and deploy their own code with no human in the loop. They do not read the security policy, and asking them nicely does not scale. So I built the thing that decides what an agent is allowed to do before it does it.
Before this: five years making a payments company safe under PCI DSS and RBI, then multi-cloud security at streaming scale. The job has not really changed — only the thing doing the deploying has.
Side A — the day jobs
Every one of these started the same way: nobody could tell me what was actually being watched.
New material — AI & agent security
Founder · Go · FastAPI · in production
A runtime security platform for AI agents — CrowdStrike, but the endpoint is an agent. It sits between an agent and the action it is about to take, decides whether that action is allowed, and blocks it in-line if it is not. Policy engine, ML threat detection, SDKs across ~20 agent frameworks, and hooks into 10 AI coding tools. Everything else in this space finds out afterwards.
Claude Code · Codex · Cursor · MDM
Most code at Composio is now written in AI coding sessions, and an instruction file cannot stop an agent doing something — it can only ask. So enforcement lives in PreToolUse hooks that intercept commit, push and PR creation inside every agent session, run the scanners, and refuse the command until it passes. Shipped fleet-wide by MDM so it reinstalls itself if removed. Instruction files ask nicely. Hooks do not.
Socket · CSPM · IaC
Agent routines that close findings instead of filing them. One queries the supply-chain scanner, patches dependency and image CVEs, and opens the PR. Another pulls HIGH cloud misconfigurations, verifies each against the live account, works out the blast radius of fixing it, and raises an IaC pull request. Nothing mutates without a rollback snapshot and one human approval.
Python · MCP · 84★ · open source
An MCP server that connects an AI assistant directly to AWS security services — GuardDuty, IAM, Access Analyzer, Inspector — so you can audit an account by asking a question rather than remembering which of a hundred API calls answers it. The most-used thing I have open-sourced.
Tailscale · microVM · VPC peeringcoming
How the agent platform actually got off the public internet: a hub-and-spoke Tailscale network with per-environment subnet routers, VPC peering chosen over Transit Gateway for non-transitive spoke isolation, private DNS that only resolves on the tailnet, and per-session microVMs that tear themselves down. The alternative is a control plane on the open internet, which is how most of them ship.
Composio · write-upcoming
What changes when the thing writing your code holds credentials, reaches your network, and has no concept of a change window — and which of the controls you already own still do anything about it.
Neo4j · LangGraph · MCPcoming
A memory layer for security agents. 29 node types, 40+ relationship types, semantic search over local embeddings, and autonomous enrichment agents that keep it current. So an agent recalls what it learned about your estate last week instead of starting cold.
Side B — things that were fine until they weren't
AWS · containers · disclosed
The thing watching your containers is only watching some of your containers. Nobody was thrilled to hear it, least of all me.
AWS · ECS · disclosed
Your production credentials are about one small bash script away from being somebody else's production credentials. Took an afternoon. Should not have.
AWS · audit logging
Your audit log is the record of what happened, right up until the part where it quietly is not. Everything looked fine. That was the problem.
GCP · shared sessions
You logged out. The session did not. It is still there. It says hello.
AWS · networking
Everything leaving your network goes through one door, and for years nobody had bothered to check who was walking out of it. Turns out: a lot of things.
AWS · IAM
A config file you have never opened can run commands as you. Sleep well.
What I do
What I am actually hired to do. The tools underneath change; these do not.
Press one to open it
Sleeve notes
The tooling underneath. Anything on this list I have broken, fixed, or been woken up by.
Cloud
Containers & runtime
AI & agents
Detection & response
Supply chain
Network & identity
Languages
Compliance
Bug bounty — the hall of fame
Apple
acknowledged
AT&T
acknowledged
Palo Alto
networks
Trustpilot
acknowledged
OYO
rooms
libssh
CVE — assigned
The libssh one has an actual CVE number attached to it, which is the closest thing this industry has to a framed certificate.
Gatefold
Eight years, five companies, one recurring discovery: the important thing was never actually being watched. I find it, I prove it, then I build the control that makes it someone's job to watch. That has been the entire career.
Five of those years at a payments company, where 50+ AWS accounts under PCI DSS and RBI means being wrong is a regulatory event rather than a bad afternoon. We took the security score from 72% to 99%, the highest in APAC, across 55 audits with zero critical findings. Then multi-cloud at streaming scale — 850+ microservices, 24 Kubernetes clusters, and one service account quietly able to impersonate anything on 72 production nodes. That one turned up on a Tuesday.
Now the strangest version yet. At Composio the agents ship code unsupervised, so I rebuilt the platform behind a private network, put scoped credentials in front of every call, and wired hooks that block a vulnerable commit on the laptop before CI ever sees it. On the side I am building Burrow, which does the same for everyone else's agents. It runs in production here.
Side B is written the way I would explain it at a conference bar: what everyone assumed, why that assumption was wrong, and exactly what it let you do next.
Bootleg recordings
Conference recordings and one demo. All of them are me explaining something I broke first.
Demo · 2024Driving an MCP server to do user and entity behaviour analytics against a live AWS account, in conversation.
DEF CON · Cloud Village · 2025The talk version: what changes when auditing a cloud estate becomes something you ask for rather than script.
Ekoparty · 2021Misconfiguration detection built entirely on AWS managed services. With Divyanshu Mehta and Harsh Varagiya.
NoNameCon · 2021Getting one view of what is happening across an estate that grew faster than anyone documented it.
Live
Back sleeve
All findings responsibly disclosed. All vendors notified. Several of them even replied. Nothing on this site is a live vulnerability, an unpatched issue, or my current employer's problem — that would be a very different kind of website, and a much shorter career.