# latacora.com

> AI-optimized mirror of latacora.com containing 50 pages totalling 50 words of clean markdown content, structured data, and semantic HTML. Original source: https://latacora.com/. Last updated: 2026-06-15T02:36:13.892Z.

Each page is available as HTML (with JSON-LD structured data) and Markdown (text-only, ideal for LLMs and RAG).

## Homepage

- [Latacora | Latacora](/content/site-root.html): Retained security teams for startups., Latacora develops, grows, and maintains information security practices for tech-forward businesses. We join your team to build (or re-build) and scale your practice to your needs. Once it makes sense to do so, we help you bring those capabilities in-house.
We’ve been in business for nearly a decade and have built the security function for some of the most high-performing organizations around, for everything from platforms, to authentication providers, to medical devices and healthcare, to financial services integrating with banks, and even the actual banks. (1 words)

## Articles & Blog Posts

- [How we work | Latacora](/content/how-we-work/index.html): How Latacora works, How Latacora works (1 words)
- [Virtual CISO | Latacora](/content/services/vciso/index.html): At the root of every security practice is a strategic leadership function that ties everything together. We help determine key risks, chart roadmaps, and communicate with management. We provide you with folks who have been in the hot seat before, armed with all the resources they need to be successful. That includes the project management necessary to ensure regular delivery towards that plan.
, At the root of every security practice is a strategic leadership function that ties everything together. We help determine key risks, chart roadmaps, and communicate with management. We provide you with folks who have been in the hot seat before, armed with all the resources they need to be successful. That includes the project management necessary to ensure regular delivery towards that plan. (1 words)
- [Lessons in logging, part 2: mapping your path to a mature security program with logs and audit trails | Latacora](/content/blog/2024/10/23/mapping-your-path-to-a-more-mature-security-program-with-logs-and-audit-trails.html): This post is the second in a series about logging and audit trails from a security perspective. For the first post in the series, see Lessons in Logging: Chopping Down Security Risks Using Audit Trails
If you’re looking to level up your security practices, logging is a good place to focus your attention. Just as logging is a core pillar of observability, comprehensive audit trails are a core pillar of a strong security program. Logs and audit trails are separate but overlapping concepts, and most companies can improve their security posture by investing in this area., This post is the second in a series about logging and audit trails from a security perspective. For the first post in the series, see Lessons in Logging: Chopping Down Security Risks Using Audit Trails
If you’re looking to level up your security practices, logging is a good place to focus your attention. Just as logging is a core pillar of observability, comprehensive audit trails are a core pillar of a strong security program. Logs and audit trails are separate but overlapping concepts, and most companies can improve their security posture by investing in this area. (1 words)
- [IT Security | Latacora](/content/services/it-security/index.html): Building an effective IT practice from scratch is often the bottleneck for our clients to scale up. We'll own everything from modern IT infrastructure management, mobile device management, remediation, phishing exercises, and even procurement, so you can get back to running your business.
, Building an effective IT practice from scratch is often the bottleneck for our clients to scale up. We'll own everything from modern IT infrastructure management, mobile device management, remediation, phishing exercises, and even procurement, so you can get back to running your business. (1 words)
- [Latacora](/content/categories/compliance/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Careers | Latacora](/content/careers/index.html): A description of careers at Latacora, A description of careers at Latacora (1 words)
- [Risk & compliance | Latacora](/content/services/risk-and-compliance/index.html): Most of our clients need to satisfy governance, risk and compliance (GRC) requirements. Many operate in regulated industries. We provide the tools and services to help clients accomplish SOC 2, ISO 27001, HIPAA, GDPR, et cetera. We help advise effective and efficient ways to get and stay compliant.
, Most of our clients need to satisfy governance, risk and compliance (GRC) requirements. Many operate in regulated industries. We provide the tools and services to help clients accomplish SOC 2, ISO 27001, HIPAA, GDPR, et cetera. We help advise effective and efficient ways to get and stay compliant. (1 words)
- [Infrastructure security | Latacora](/content/services/infrasec/index.html): Latacora monitors, protects and hardens your infrastructure, including Cloud infrastructure (like AWS, GCP, or Azure) and infrastructure more broadly (like GitHub, Google Workspace or Okta). We'll help identify and quantify both clear-cut issues, like infrastructure being exposed to the Internet that shouldn't be, to helping you reason about and manage more subtle risks like the number of applications with access to sensitive data.
, Latacora monitors, protects and hardens your infrastructure, including Cloud infrastructure (like AWS, GCP, or Azure) and infrastructure more broadly (like GitHub, Google Workspace or Okta). We'll help identify and quantify both clear-cut issues, like infrastructure being exposed to the Internet that shouldn't be, to helping you reason about and manage more subtle risks like the number of applications with access to sensitive data. (1 words)
- [Blog | Latacora](/content/blog/page/4/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Latacora](/content/categories/risk-compliance/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Latacora](/content/categories/events/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Bit by bit: how Latacora helped Notion build security that scales | Latacora](/content/blog/2025/08/29/bit-by-bit-latacora-notion/index.html): Security rarely tops the priority list for startups - but that doesn’t make
it optional.
Running a startup is no small feat. Facing enormous pressure to address a
never-ending list of priorities (finding market fit, fundraising, launching new
features, scaling infrastructure, etc.) security often becomes a “later”
issue……until it can’t be. Even when companies know they need help, the breadth
of the problem can be intimidating. Application security, cloud infrastructure,
third-party vendors, compliance, cryptography: any resource-constrained startup
will be hard-pressed to find a unicorn hire who can own all these
responsibilities equally well., Security rarely tops the priority list for startups - but that doesn’t make it optional.
Running a startup is no small feat. Facing enormous pressure to address a never-ending list of priorities (finding market fit, fundraising, launching new features, scaling infrastructure, etc.) security often becomes a “later” issue……until it can’t be. Even when companies know they need help, the breadth of the problem can be intimidating. Application security, cloud infrastructure, third-party vendors, compliance, cryptography: any resource-constrained startup will be hard-pressed to find a unicorn hire who can own all these responsibilities equally well. (1 words)
- [Contact | Latacora](/content/contact/index.html): How to contact Latacora, How to contact Latacora (1 words)
- [Introducing Replik8s, a Modern Security Tool for Kubernetes | Latacora](/content/blog/2025/09/22/introducing-replik8s/index.html): Replik8s is a modern open source Kubernetes auditing tool. It is designed to address the common limitations of traditional security tools, which rely on narrow data collection and predefined logic. RepliK8s allows cloning Kubernetes clusters and serving back exact replicas of the original data, as well as conducting analysis through a tool-agnostic query language. This architecture enables flexible analysis, historical investigation, and broad applicability., Replik8s is a modern open source Kubernetes auditing tool. It is designed to address the common limitations of traditional security tools, which rely on narrow data collection and predefined logic. RepliK8s allows cloning Kubernetes clusters and serving back exact replicas of the original data, as well as conducting analysis through a tool-agnostic query language. This architecture enables flexible analysis, historical investigation, and broad applicability. (1 words)
- [Lessons in logging: chopping down security risks using audit trails | Latacora](/content/blog/2023/11/28/lessons-in-logging-chopping-down-security-risks-using-audit-trails.html): This post is the first in a series about logging and audit trails from a security perspective. For the next post in the series, see Lessons in Logging, Part 2: Mapping Your Path to a Mature Security Program with Logs and Audit Trails
At Latacora, we bootstrap security practices. We partner with companies that frequently have minimally developed security programs, work with them to figure out the right security practices for their current size, and then help them evolve and scale those practices as their business matures., This post is the first in a series about logging and audit trails from a security perspective. For the next post in the series, see Lessons in Logging, Part 2: Mapping Your Path to a Mature Security Program with Logs and Audit Trails
At Latacora, we bootstrap security practices. We partner with companies that frequently have minimally developed security programs, work with them to figure out the right security practices for their current size, and then help them evolve and scale those practices as their business matures. (1 words)
- [Blog | Latacora](/content/blog/page/5/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Blog | Latacora](/content/blog/page/2/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Blog | Latacora](/content/blog/page/3/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Latacora](/content/categories/managed-services/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Our Approach to Building Security Tooling | Latacora](/content/blog/2023/11/01/our-approach-to-building-security-tooling/index.html): Our Approach to Building Security Tooling, Our Approach to Building Security Tooling (1 words)
- [Latacora](/content/categories/cloud-security/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Blog | Latacora](/content/blog/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Services | Latacora](/content/services/index.html): A description of Latacora's services, A description of Latacora's services (1 words)
- [Latacora](/content/categories/infrastructure-security/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Application security, cryptography & SDLC | Latacora](/content/services/appsec/index.html): We'll help you build a right-sized application and product security practice, which includes design work, testing, systems development life cycle security, and supply chain security—as well as long-tail skills like cryptography expertise.
, We'll help you build a right-sized application and product security practice, which includes design work, testing, systems development life cycle security, and supply chain security—as well as long-tail skills like cryptography expertise. (1 words)
- [sitemap-xml.html](/content/sitemap-xml.html) (1 words)
- [Datomic and Content Addressable Techniques: An Ultimate Data Wonderland | Latacora](/content/blog/2024/09/13/datomic-and-content-addressable-techniques/index.html): Datomic and Content Addressable Techniques: An Ultimate Data Wonderland, Datomic and Content Addressable Techniques: An Ultimate Data Wonderland (1 words)
- [Latacora](/content/categories/architecture/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Stop using encrypted email | Latacora](/content/blog/2020/02/19/stop-using-encrypted-email/index.html): Stop using encrypted email, Stop using encrypted email (1 words)
- [The SOC2 starting seven | Latacora](/content/blog/2020/03/12/soc2-starting-seven/index.html): The SOC2 starting seven, The SOC2 starting seven (1 words)
- [Remediating AWS IMDSv1 | Latacora](/content/blog/2021/08/11/remediating-aws-imdsv1/index.html): Remediating AWS IMDSv1, Remediating AWS IMDSv1 (1 words)
- [Detection & response | Latacora](/content/services/detection-and-response/index.html): We help you build scalable, complete detection & response story that you can make your own. We deploy top-tier endpoint detection, round-the-clock triage, rule tuning, threat intelligence, integrated incident response retainers, custom integrations, et cetera around single-tenant instances of Panther, an industry-leading SIEM.
, We help you build scalable, complete detection & response story that you can make your own. We deploy top-tier endpoint detection, round-the-clock triage, rule tuning, threat intelligence, integrated incident response retainers, custom integrations, et cetera around single-tenant instances of Panther, an industry-leading SIEM. (1 words)
- [Real World Crypto 2024 | Latacora](/content/blog/2024/05/07/real-world-crypto-2024/index.html): We traveled to Toronto this year to attend
RWC 2024. The conference was held in
TIFF Lightbox located in the
city’s downtown; the venue is the headquarters for the Toronto Film Festival
and contains five cinema rooms. RWC is a single-tracked conference and there’s
no hard requirement that talks are backed by papers. Each RWC includes the
Levchin prize ceremony for major
achievements in applied cryptography, several invited talks and the lightning
talks session., We traveled to Toronto this year to attend RWC 2024. The conference was held in TIFF Lightbox located in the city’s downtown; the venue is the headquarters for the Toronto Film Festival and contains five cinema rooms. RWC is a single-tracked conference and there’s no hard requirement that talks are backed by papers. Each RWC includes the Levchin prize ceremony for major achievements in applied cryptography, several invited talks and the lightning talks session. (1 words)
- [Frequently Asked Questions from Strange Loop 2023 | Latacora](/content/blog/2023/09/27/strange-loop-2023/index.html): The last Strange Loop conference was held September 21-22, 2023 at St. Louis
Union Station. The conference is targeted towards developers; the speakers are
often sharing their knowledge on new and inventive ways to use technology. At
our sponsor booth at Union Station, attendees asked two (okay, three) questions
most often:

What is Latacora? Your name is on the lanyards, and I’m curious to know what
you do.
Why sponsor Strange Loop?
Can I take a plant?

The first one isn’t hard for the folks from our team: Latacora is a consultancy
that bootstraps security for startups. We have a team of experts helping our
clients with most security-related things: application security, cloud
security, corporate security, compliance, and more. We also have a team of
security architects, cryptographers, and project managers supporting our
clients. These professionals are equipped with power tools built to make their
jobs more efficient and to help our clients improve their security posture., The last Strange Loop conference was held September 21-22, 2023 at St. Louis Union Station. The conference is targeted towards developers; the speakers are often sharing their knowledge on new and inventive ways to use technology. At our sponsor booth at Union Station, attendees asked two (okay, three) questions most often:
What is Latacora? Your name is on the lanyards, and I’m curious to know what you do. Why sponsor Strange Loop? Can I take a plant? The first one isn’t hard for the folks from our team: Latacora is a consultancy that bootstraps security for startups. We have a team of experts helping our clients with most security-related things: application security, cloud security, corporate security, compliance, and more. We also have a team of security architects, cryptographers, and project managers supporting our clients. These professionals are equipped with power tools built to make their jobs more efficient and to help our clients improve their security posture. (1 words)
- [A case for password hashing with delegation | Latacora](/content/blog/2023/12/22/case-for-password-hashing/index.html): When people talk about PBKDFs (Password Based Key Derivation Functions), this
is usually either in the context of secure password storage, or in the context
of how to derive cryptographic keys from potentially low-entropy passwords. The
Password Hashing Competition (PHC, 2013-2015) was an open competition to derive
new password hashing algorithms, resulting in Argon2 hash as its winner. Apart
from achieving general hash security, many of the candidates focused on
achieving resistance to parallel attacks on available hardware such as GPUs., When people talk about PBKDFs (Password Based Key Derivation Functions), this is usually either in the context of secure password storage, or in the context of how to derive cryptographic keys from potentially low-entropy passwords. The Password Hashing Competition (PHC, 2013-2015) was an open competition to derive new password hashing algorithms, resulting in Argon2 hash as its winner. Apart from achieving general hash security, many of the candidates focused on achieving resistance to parallel attacks on available hardware such as GPUs. (1 words)
- [Cryptographic Right Answers: Post Quantum Edition | Latacora](/content/blog/post-quantum-cryptographic-right-answers/index.html): One of our favorite blog posts is our
“crypto right answers”
post. It’s intended to be an easy-to-use guide to help engineers pick the best
cryptography choices without needing to go too far down a rabbit hole. With
post-quantum cryptography (PQC) recently transitioning from an academic
research topic to a more practical cryptography concern we figured it’s time
for an update of our cryptography recommendations.
One thing that makes recommending PQC challenging is that historically, we’ve
been able to provide “better” answers for classical cryptography. Faster and
bigger hashes, stronger password KDFs, easier-to-use primitives… These things
all have the same fundamental “shape”: you can take an existing design and drop
in something else to make it better. MD5 and BLAKE3 are not comparable in
strength, but you can just use BLAKE3 in place of MD5 and get something that’s
just far better with minimal API changes., One of our favorite blog posts is our “crypto right answers” post. It’s intended to be an easy-to-use guide to help engineers pick the best cryptography choices without needing to go too far down a rabbit hole. With post-quantum cryptography (PQC) recently transitioning from an academic research topic to a more practical cryptography concern we figured it’s time for an update of our cryptography recommendations.
One thing that makes recommending PQC challenging is that historically, we’ve been able to provide “better” answers for classical cryptography. Faster and bigger hashes, stronger password KDFs, easier-to-use primitives… These things all have the same fundamental “shape”: you can take an existing design and drop in something else to make it better. MD5 and BLAKE3 are not comparable in strength, but you can just use BLAKE3 in place of MD5 and get something that’s just far better with minimal API changes. (1 words)
- [Latacora](/content/categories/cryptography/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [OIDC workload identity on AWS | Latacora](/content/blog/2025/11/04/aws-oidc-workload-identity/index.html): Turn AWS IAM identities into OIDC tokens for workload identity for better security and developer experience when authenticating to external services like Tailscale.
, Turn AWS IAM identities into OIDC tokens for workload identity for better security and developer experience when authenticating to external services like Tailscale. (1 words)
- [Latacora & Vanta - Howdy (Managed Service) Partner! | Latacora](/content/blog/2024/09/09/latacora-vanta-howdy-msp/index.html): Exciting news! Latacora is teaming up with Vanta to supercharge your
compliance game. We now combine Latacora’s security expertise with Vanta’s
compliance platform to help you reach your compliance goals faster than ever.
As a Vanta managed service provider (MSP), Latacora can help you tackle your
compliance goals quickly and efficiently, freeing you to focus on growing your
business and building trust with your customers.
Here’s the scoop on why using Vanta through Latacora is a game-changer:, Exciting news! Latacora is teaming up with Vanta to supercharge your compliance game. We now combine Latacora’s security expertise with Vanta’s compliance platform to help you reach your compliance goals faster than ever. As a Vanta managed service provider (MSP), Latacora can help you tackle your compliance goals quickly and efficiently, freeing you to focus on growing your business and building trust with your customers.
Here’s the scoop on why using Vanta through Latacora is a game-changer: (1 words)
- [Latacora](/content/categories/detection-response/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Latacora](/content/categories/tooling/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Latacora](/content/categories/sales-enablement/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Privacy for the newly appointed (and already exasperated) DPO | Latacora](/content/blog/2025/06/27/privacy-for-the-newly-appointed-and-already-exasperated-dpo.html): Every other week, regulators around the world bombard their constituents with
new data protection laws and acronyms. As the person who was just voluntold
you’re now responsible for privacy at your startup, in addition to all your
other duties and without any additional resources, how can you possibly be
expected to keep up—let alone contextualize that information to maintain
compliance?
Privacy, at its core, is an ethical issue, which means the solution to your
privacy challenges is deceptively simple: do the right thing and be
transparent with your customers. That’s it. That’s what everyone means when
they say “privacy by design.”, Every other week, regulators around the world bombard their constituents with new data protection laws and acronyms. As the person who was just voluntold you’re now responsible for privacy at your startup, in addition to all your other duties and without any additional resources, how can you possibly be expected to keep up—let alone contextualize that information to maintain compliance?
Privacy, at its core, is an ethical issue, which means the solution to your privacy challenges is deceptively simple: do the right thing and be transparent with your customers. That’s it. That’s what everyone means when they say “privacy by design.” (1 words)
- [ECS on EC2: Covering Gaps in IMDS Hardening | Latacora](/content/blog/2025/10/02/ecs-on-ec2-covering-gaps-in-imds-hardening/index.html): Blocking EC2 IMDS access for ECS workloads is an important security recommendation. By default, ECS containers are able to access the IMDS endpoint and retrieve host EC2's instance profile credentials. Weak task-level isolation offered by ECS on EC2 workloads makes this an even greater security concern. In this post, we explore the nuances and gaps in blocking IMDS access for ECS tasks running on EC2 instances across different networking modes and IMDS configurations., Blocking EC2 IMDS access for ECS workloads is an important security recommendation. By default, ECS containers are able to access the IMDS endpoint and retrieve host EC2's instance profile credentials. Weak task-level isolation offered by ECS on EC2 workloads makes this an even greater security concern. In this post, we explore the nuances and gaps in blocking IMDS access for ECS tasks running on EC2 instances across different networking modes and IMDS configurations. (1 words)
- [Writing MCP servers in Clojure with Ring and Malli | Latacora](/content/blog/2025/11/10/mcp-sdk/index.html): Writing compliant Model Context Protocol (MCP) servers in Clojure using Ring and Malli.
, Writing compliant Model Context Protocol (MCP) servers in Clojure using Ring and Malli. (1 words)
- [Latacora](/content/categories/development/index.html): Retained security teams for startups., Retained security teams for startups. (1 words)
- [Sales enablement | Latacora](/content/services/sales-enablement/index.html): Effective security practices recognize that your customers are important stakeholders, too. We'll sell your prospects on your security practice, and answer security questionnaires. Because we've got security programs ready to go, we'll make it so you never lose another deal to security controls, and help you turn security into a differentiator.
, Effective security practices recognize that your customers are important stakeholders, too. We'll sell your prospects on your security practice, and answer security questionnaires. Because we've got security programs ready to go, we'll make it so you never lose another deal to security controls, and help you turn security into a differentiator. (1 words)
- [categories/index.html](/content/categories/index.html) (1 words)
- [Dumb security questionnaires | Latacora](/content/blog/2018/05/04/dumb-security-questionnaires/index.html): Dumb security questionnaires, Dumb security questionnaires (1 words)

## Resources

- [Full Page Index](/index.html): Browse all cached pages with rich metadata
- [About This Cache](/content/about.html): Methodology, technical details, and usage guidelines
- [XML Sitemap](/sitemap.xml): Machine-readable sitemap for crawler discovery
- [Robots.txt](/robots.txt): Crawler directives