Field notes on API abuse, anomaly detection, and developer-first tooling.https://navonstack.com/https://navonstack.com/blog/posts/microservices-broke-the-security-perimeter/https://navonstack.com/blog/posts/microservices-broke-the-security-perimeter/The perimeter model assumed one front door. Microservices gave you dozens. Here's what that actually means for runtime security — and why the tooling most teams rely on was built for an architecture that no longer exists.Thu, 02 Jul 2026 00:00:00 GMThttps://navonstack.com/blog/posts/detection-you-can-read/https://navonstack.com/blog/posts/detection-you-can-read/Most API security tools answer 'is this an attack?' with a number you have to trust. The better question is whether the engineer on call can read the rule that fired — and disagree with it.Sun, 28 Jun 2026 00:00:00 GMThttps://navonstack.com/blog/posts/what-makes-an-alert-worth-waking-up-for/https://navonstack.com/blog/posts/what-makes-an-alert-worth-waking-up-for/An alert that doesn't tell you how serious it is, or why it fired, isn't help — it's homework. Here's the case for detection you can read at 3am, not a score you have to trust.Sat, 20 Jun 2026 00:00:00 GMThttps://navonstack.com/blog/posts/why-api-abuse-looks-valid/https://navonstack.com/blog/posts/why-api-abuse-looks-valid/The dangerous API requests don't fail authentication. They pass it — and then do something they shouldn't. Here's why that's hard to catch, and what actually works.Sat, 13 Jun 2026 00:00:00 GMThttps://navonstack.com/blog/posts/the-dead-mans-switch-for-telemetry/https://navonstack.com/blog/posts/the-dead-mans-switch-for-telemetry/Most monitoring tells you when something fires. The more dangerous failure is when your telemetry goes quiet — and nothing tells you at all. Here's how APIGuard treats silence as a security event.Wed, 27 May 2026 00:00:00 GMThttps://navonstack.com/blog/posts/why-valid-traffic-can-still-be-dangerous/https://navonstack.com/blog/posts/why-valid-traffic-can-still-be-dangerous/Most API attacks don't fail authentication — they authenticate successfully, then do something they shouldn't. Here's why that's the hard part.Wed, 20 May 2026 00:00:00 GMT