Blog

Updates, insights, and commentary from the OSA community. Tracking the evolution of security architecture since 2008.

• Russell Wing

ATT&CK v20, API 1.3 and new framework mappings

OSA's ATT&CK matrix now runs on MITRE ATT&CK Enterprise v20.0, released on 13 October, joined to NIST SP 800-53 through the Center for Threat-Informed Defense's (CTID) published mapping. We rebuilt it from MITRE's and CTID's own data, it now works on a phone, and the page is a tenth of its old size. Version 1.3 of the OSA API gives agents the same data in a request or two, and we've added the EU AI Act and moved more of our framework mappings onto published crosswalks.

• OSA Core Team

Blockchain Security Architecture: From Tokenised Assets to Digital Currencies

The security architecture for blockchain and distributed ledger technology has matured past the point where it can be treated as a single problem. Tokenised assets, decentralised identity, zero-knowledge proofs, and central bank digital currencies are distinct architectural domains with distinct threat models, distinct regulatory regimes, and distinct control requirements. Treating them as variations of "blockchain security" is like treating API security and network segmentation as variations of "internet security" -- technically not wrong, but not useful for anyone who has to build the thing.

• Russell Wing

Building the Most Machine-Readable Security Architecture on the Internet

Cloudflare announced Markdown for Agents this week -- a feature that converts HTML pages to markdown on the fly when an AI agent requests them. It is a smart solution to a real problem: AI agents waste tokens parsing HTML when they just need the content. Claude Code, OpenCode, and other coding agents already send `Accept: text/markdown` in their request headers, and Cloudflare intercepts that to serve clean markdown instead of raw HTML.

• Chris Lethaby

Framework Mappings and Coverage Analysis for 21 Compliance Frameworks

If you are a security architect, GRC manager, or compliance lead, you have almost certainly maintained a spreadsheet that maps controls from one framework to another. You have sat in meetings where someone asks which ISO 27001 clauses are satisfied by the NIST controls you have already implemented. You have spent days preparing evidence for an auditor who needs to see the same controls through the lens of a different framework.