DEV Community: ShadowStrike

Automating Essential Eight Compliance Checks with PowerShell

ShadowStrike — Sun, 26 Apr 2026 22:11:56 +0000

Version 1.0.0

If you work in Australian IT, cybersecurity, or digital forensics, you've encountered the Essential Eight. It's referenced in government procurement requirements, security assessments, incident response frameworks, and organisational policies across both public and private sectors.

The Australian Signals Directorate's Essential Eight is a set of eight baseline mitigation strategies designed to protect Windows environments against cyber threats. Checking compliance manually is time-consuming and error-prone. In this tutorial, you'll build a PowerShell script that automates Essential Eight audits, produces colour-coded console output, and writes detailed compliance reports to timestamped files.

What You'll Build

A PowerShell script called essential_eight.ps1 that checks a Windows system against all eight ASD mitigation strategies and produces a comprehensive audit report showing PASS/FAIL/WARN/INFO status for each control.

Prerequisites

PowerShell 5.1 or later (Windows 10+)
Administrator privileges recommended (some checks require elevated access)
No external modules or dependencies

Understanding the Essential Eight

Before building the script, it's worth understanding what each strategy actually checks. The ASD publishes detailed guidance, but the practical questions are:

1. Application Control — Is there a mechanism (AppLocker, Windows Defender Application Control) preventing unauthorised executables from running?

2. Patch Applications — Are third-party applications kept up to date? Is Windows Update active?

3. Configure Microsoft Office Macro Settings — Are macros restricted to prevent malicious Office documents from executing code?

4. User Application Hardening — Are legacy and high-risk features (Internet Explorer, Windows Script Host, PowerShell v2) disabled or restricted?

5. Restrict Administrative Privileges — Are admin accounts limited? Is UAC enabled? Are standard users running with least privilege?

6. Patch Operating Systems — Is the OS on a supported and current build?

7. Multi-Factor Authentication — Is MFA enforced, especially for privileged access?

8. Regular Backups — Are backups in place and recent? Are they protected from modification?

Each strategy has Maturity Levels (ML1, ML2, ML3) in the full ASD framework. This script focuses on ML1 baseline checks — the foundation that must exist before maturity level progression begins.

The Complete Script

Here's the full implementation (condensed for readability - full version on GitHub):

# Essential Eight Compliance Checker
# Author: ShadowStrike (Strategos)

param(
    [Parameter(Mandatory=$false)]
    [string]$OutputDir = ".",

    [Parameter(Mandatory=$false)]
    [switch]$Verbose
)

# Initialise report
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$outputFile = Join-Path $OutputDir "EssentialEight_Audit_$timestamp.txt"
$report = @()

# Track results
$passCount = 0
$failCount = 0
$warnCount = 0

function Write-Check {
    param([string]$Strategy, [string]$Check, [string]$Status, [string]$Detail = "")

    $color = switch ($Status) {
        "PASS" { "Green"; $script:passCount++ }
        "FAIL" { "Red"; $script:failCount++ }
        "WARN" { "Yellow"; $script:warnCount++ }
        "INFO" { "Cyan" }
    }

    $line = "[$Status] $Strategy - $Check"
    if ($Detail) { $line += ": $Detail" }

    Write-Host $line -ForegroundColor $color
    $script:report += $line
}

# STRATEGY 1: APPLICATION CONTROL
try {
    $appLockerPolicy = Get-AppLockerPolicy -Effective -ErrorAction Stop
    if ($appLockerPolicy.RuleCollections.Count -gt 0) {
        Write-Check "AppControl" "AppLocker Policy" "PASS" "Effective rules configured"
    } else {
        Write-Check "AppControl" "AppLocker Policy" "FAIL" "No effective rules"
    }
} catch {
    Write-Check "AppControl" "AppLocker Policy" "FAIL" "Not configured"
}

# STRATEGY 2: PATCH APPLICATIONS
$wuService = Get-Service -Name wuauserv -ErrorAction SilentlyContinue
if ($wuService -and $wuService.Status -eq "Running") {
    Write-Check "Patching" "Windows Update Service" "PASS" "Running"
} else {
    Write-Check "Patching" "Windows Update Service" "FAIL" "Not running"
}

# Check last update date
$session = New-Object -ComObject Microsoft.Update.Session
$searcher = $session.CreateUpdateSearcher()
$history = $searcher.QueryHistory(0, 1) | Select-Object -First 1
$lastUpdate = $history.Date
$daysSince = (Get-Date) - $lastUpdate

if ($daysSince.Days -le 30) {
    Write-Check "Patching" "Last Update" "PASS" "$([math]::Round($daysSince.TotalDays)) days ago"
} else {
    Write-Check "Patching" "Last Update" "FAIL" "$([math]::Round($daysSince.TotalDays)) days ago (outdated)"
}

# STRATEGY 3: OFFICE MACRO SETTINGS
$excelPath = "HKCU:\Software\Microsoft\Office\16.0\Excel\Security"
if (Test-Path $excelPath) {
    $vbaWarnings = (Get-ItemProperty -Path $excelPath -Name VBAWarnings).VBAWarnings
    if ($vbaWarnings -eq 3 -or $vbaWarnings -eq 4) {
        Write-Check "MacroSettings" "Excel VBA" "PASS" "Restricted"
    } else {
        Write-Check "MacroSettings" "Excel VBA" "FAIL" "Unrestricted"
    }
}

# STRATEGY 4: USER APPLICATION HARDENING
$psv2 = Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root
if ($psv2.State -eq "Disabled") {
    Write-Check "Hardening" "PowerShell v2" "PASS" "Disabled"
} else {
    Write-Check "Hardening" "PowerShell v2" "FAIL" "Enabled (should be removed)"
}

$langMode = $ExecutionContext.SessionState.LanguageMode
if ($langMode -eq "ConstrainedLanguage") {
    Write-Check "Hardening" "PS Language Mode" "PASS" "ConstrainedLanguage"
} else {
    Write-Check "Hardening" "PS Language Mode" "WARN" "FullLanguage (unrestricted)"
}

# STRATEGY 5: RESTRICT ADMIN PRIVILEGES
$uacPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System"
$uacEnabled = (Get-ItemProperty -Path $uacPath -Name EnableLUA).EnableLUA
if ($uacEnabled -eq 1) {
    Write-Check "Privileges" "UAC" "PASS" "Enabled"
} else {
    Write-Check "Privileges" "UAC" "FAIL" "Disabled"
}

# STRATEGY 6: PATCH OPERATING SYSTEMS
$os = Get-CimInstance Win32_OperatingSystem
$osBuild = $os.BuildNumber
if ([int]$osBuild -ge 19041) {
    Write-Check "OS Patching" "OS Support" "PASS" "Supported build"
} else {
    Write-Check "OS Patching" "OS Support" "FAIL" "Legacy build"
}

# STRATEGY 7: MULTI-FACTOR AUTHENTICATION
# Note: Full MFA assessment requires Azure AD audit
Write-Check "MFA" "Assessment" "INFO" "Requires directory-level audit"

# STRATEGY 8: REGULAR BACKUPS
$vssService = Get-Service -Name VSS
if ($vssService.Status -eq "Running") {
    Write-Check "Backups" "Volume Shadow Copy" "PASS" "Running"
} else {
    Write-Check "Backups" "Volume Shadow Copy" "WARN" "Not running"
}

# Write summary
Write-Host "`n[AUDIT SUMMARY]"
Write-Host "  PASS: $passCount" -ForegroundColor Green
Write-Host "  FAIL: $failCount" -ForegroundColor Red
Write-Host "  WARN: $warnCount" -ForegroundColor Yellow

$report | Out-File -FilePath $outputFile -Encoding UTF8

How to Use It

Troubleshooting: Execution Policy

If you see an error about scripts being disabled or not digitally signed:

Step 1: Set execution policy

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Step 2: Unblock the file if downloaded

Unblock-File .\essential_eight.ps1

Windows marks files downloaded from GitHub with Zone.Identifier metadata. Even with RemoteSigned policy, these files are blocked unless digitally signed or explicitly unblocked.

Check your current policy with Get-ExecutionPolicy -List.

Security Note: Read the Code Before You Run It

This script is not digitally signed. Code signing certificates cost $200-500/year and are unnecessary for open-source scripts where you can read the source code yourself.

Before running this or any PowerShell script:

Read it completely — every line, every function, every registry path
Understand what it does — does it match the stated purpose?
Check for risks — network calls, file deletions, credential access

Apply the ABC principle:

Assume nothing
Believe nothing
Check everything

A digital signature tells you WHO wrote code, not WHETHER it's safe. You are the final security control. Never execute code you haven't personally reviewed and understood.

Basic Audit

.\essential_eight.ps1

Runs the audit and writes report to EssentialEight_Audit_[timestamp].txt in the current directory.

Specify Output Directory

.\essential_eight.ps1 -OutputDir "C:\Compliance\Reports"

Run as Administrator

Some checks require elevated privileges. Right-click PowerShell → "Run as Administrator", then:

.\essential_eight.ps1

Understanding the Output

The script produces colour-coded console output:

[PASS] (green) - Control meets baseline requirements
[FAIL] (red) - Control does not meet requirements
[WARN] (yellow) - Partial compliance or requires manual review
[INFO] (cyan) - Informational finding, not a compliance check

Sample output (example system for demonstration - not real audit data):

[ESSENTIAL EIGHT COMPLIANCE AUDIT]
System: WORKSTATION-01

[STRATEGY 1: APPLICATION CONTROL]
[PASS] AppControl - AppLocker Policy: Effective rules configured
[INFO] AppControl - WDAC Policy: Not deployed (AppLocker in use)

[STRATEGY 2: PATCH APPLICATIONS]
[PASS] Patching - Windows Update Service: Running
[PASS] Patching - Last Update: 2026-04-18 - 6 days ago

[STRATEGY 3: OFFICE MACRO SETTINGS]
[PASS] MacroSettings - Excel VBA Warnings: Macros disabled (Value: 3)
[PASS] MacroSettings - Word VBA Warnings: Notification enabled (Value: 4)

[STRATEGY 4: USER APPLICATION HARDENING]
[PASS] Hardening - PowerShell v2: Disabled
[PASS] Hardening - PowerShell Version: v5.1
[WARN] Hardening - PowerShell Language Mode: FullLanguage (unrestricted)
[PASS] Hardening - Script Block Logging: Enabled

[STRATEGY 5: RESTRICT ADMINISTRATIVE PRIVILEGES]
[PASS] Privileges - Current User Role: Running as standard user
[PASS] Privileges - UAC Status: Enabled
[PASS] Privileges - Local Administrators: 2 account(s) - acceptable range

[STRATEGY 6: PATCH OPERATING SYSTEMS]
[INFO] OS Patching - Operating System: Microsoft Windows 10 Pro (Build 19045)
[PASS] OS Patching - OS Support Status: Windows 10 version 2004+ (supported)

[STRATEGY 7: MULTI-FACTOR AUTHENTICATION]
[INFO] MFA - Windows Hello: Credential provider detected
[INFO] MFA - Credential Providers: 3 provider(s) registered
[INFO] MFA - Note: Full MFA assessment requires Azure AD / Active Directory audit

[STRATEGY 8: REGULAR BACKUPS]
[INFO] Backups - Windows Backup Service: Not active (may use third-party)
[PASS] Backups - Volume Shadow Copy: Running
[PASS] Backups - Latest Shadow Copy: 2026-04-23 - 1 days ago

[AUDIT SUMMARY]
  PASS: 15
  FAIL: 0
  WARN: 1

The timestamped report file contains the same information in plain text format for archiving.

Code Walkthrough

Strategy 1: Application Control

Checks for AppLocker or Windows Defender Application Control (WDAC):

$appLockerPolicy = Get-AppLockerPolicy -Effective
if ($appLockerPolicy.RuleCollections.Count -gt 0) {
    Write-Check "AppControl" "AppLocker Policy" "PASS" "Effective rules configured"
}

AppLocker policies can be deployed via Group Policy or locally. The -Effective parameter returns the combined result of all policies affecting the system.

For WDAC, the script checks for policy files in C:\Windows\System32\CodeIntegrity\CiPolicies\Active\.

Strategy 2: Patch Applications

Verifies Windows Update service is running and checks last update date:

$session = New-Object -ComObject Microsoft.Update.Session
$searcher = $session.CreateUpdateSearcher()
$history = $searcher.QueryHistory(0, 1) | Select-Object -First 1
$lastUpdate = $history.Date
$daysSince = (Get-Date) - $lastUpdate

The Windows Update COM API provides detailed patch history. This check flags systems where the last update was >30 days ago as outdated.

Strategy 3: Office Macro Settings

Checks registry settings for Excel and Word macro behaviour:

$excelPath = "HKCU:\Software\Microsoft\Office\16.0\Excel\Security"
$vbaWarnings = (Get-ItemProperty -Path $excelPath -Name VBAWarnings).VBAWarnings

VBAWarnings values:

1 = Enable all macros (dangerous)
2 = Disable all with notification
3 = Disable all except digitally signed
4 = Disable all without notification (most secure)

Values 3 and 4 meet Essential Eight ML1 baseline.

Strategy 4: User Application Hardening

Multiple checks including PowerShell v2 removal and script block logging:

$psv2 = Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root
if ($psv2.State -eq "Disabled") {
    Write-Check "Hardening" "PowerShell v2" "PASS" "Disabled"
}

PowerShell v2 lacks modern security features (script block logging, Constrained Language Mode support) and should be removed from all systems.

Script block logging check:

$scriptBlockPath = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
$scriptBlockEnabled = (Get-ItemProperty -Path $scriptBlockPath -Name EnableScriptBlockLogging).EnableScriptBlockLogging

When enabled (value = 1), all PowerShell script execution is logged to Windows Event Log, providing audit trails for forensic investigation.

Strategy 5: Restrict Administrative Privileges

Checks UAC status and local administrator count:

$uacPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System"
$uacEnabled = (Get-ItemProperty -Path $uacPath -Name EnableLUA).EnableLUA

$admins = Get-LocalGroupMember -Group "Administrators"

UAC (User Account Control) prompts for elevation when administrative actions are attempted. Disabling UAC is a common misconfiguration that violates Essential Eight requirements.

The administrator count check flags systems with excessive admin accounts. Typically, only built-in Administrator and one domain admin account should exist on workstations.

Strategy 6: Patch Operating Systems

Verifies OS is on a supported build:

$os = Get-CimInstance Win32_OperatingSystem
$osBuild = $os.BuildNumber

if ([int]$osBuild -ge 19041) {
    Write-Check "OS Patching" "OS Support" "PASS" "Supported build"
}

Build 19041 = Windows 10 version 2004, the minimum currently-supported consumer version. Enterprise LTSC versions may have different support timelines.

Strategy 7: Multi-Factor Authentication

MFA assessment requires directory-level audit (Azure AD, Active Directory):

$credProviders = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers"

The script checks for Windows Hello and registered credential providers, but full MFA enforcement validation requires checking conditional access policies in Azure AD or examining GPO settings for smart card requirements.

Strategy 8: Regular Backups

Checks Volume Shadow Copy Service and recent shadow copies:

$shadows = Get-CimInstance Win32_ShadowCopy | Where-Object { $_.VolumeName -like "*C:*" }
$latestShadow = $shadows | Sort-Object InstallDate -Descending | Select-Object -First 1
$daysSince = (Get-Date) - $latestShadow.InstallDate

Shadow copies are point-in-time snapshots used for System Restore and file recovery. The script flags systems where the latest shadow copy is >7 days old.

Real-World Use Cases

Pre-audit preparation: Run this script on sample systems before formal compliance assessments to identify gaps early.

Continuous monitoring: Schedule the script as a daily task and email the report to security teams. Track compliance drift over time.

Incident response baseline: After a security incident, run the script on affected systems to document Essential Eight posture at the time of compromise.

Procurement verification: When deploying new workstations, run the audit to verify vendor configuration meets baseline requirements before acceptance.

Maturity level progression: Use the baseline audit results to identify systems ready for ML2/ML3 implementation.

Extending the Script

HTML report generation: Replace the plain-text output with an HTML file including coloured tables and charts.

Email integration: Add Send-MailMessage to automatically email reports to compliance teams.

Remote execution: Wrap the script in Invoke-Command to audit multiple systems from a central management workstation.

SIEM integration: Parse the output and send findings to a SIEM platform for centralised compliance monitoring.

Remediation actions: Add a -Remediate switch that automatically fixes common failures (enable UAC, remove PowerShell v2, enable script block logging).

Maturity Levels Beyond ML1

This script focuses on ML1 (baseline) checks. The ASD Essential Eight Maturity Model has three levels:

Maturity Level 1: Partly aligned with intent. Baseline controls exist but may not be comprehensive.

Maturity Level 2: Mostly aligned with intent. Controls cover most assets and attack vectors.

Maturity Level 3: Fully aligned with intent. Comprehensive controls across all assets with robust monitoring.

Progression from ML1 → ML2 → ML3 requires increasingly stringent technical controls and centralised management. For example:

Application Control ML1: AppLocker with basic rules
Application Control ML2: Centralised AppLocker or WDAC with allow-listing
Application Control ML3: WDAC with cryptographic verification of all executables

This script provides the ML1 foundation. Assessing ML2/ML3 compliance requires additional checks beyond what local PowerShell can determine (requires SCCM, Intune, or GPO reporting).

GitHub Repository

The complete script, sample reports, and this tutorial are available on GitHub:

ShadowStrike-CTF / essential-eight-checklist

PowerShell scripts for practical Essential Eight compliance checking on Windows systems.

essential-eight-checklist

PowerShell scripts for practical Essential Eight compliance checking on Windows systems.

View on GitHub

Conclusion

Essential Eight compliance doesn't require expensive enterprise tools. PowerShell provides native cmdlets for checking application control, patching status, user hardening, privilege restrictions, and backup configurations.

This script packages those checks into a practical audit workflow that runs on any Windows 10/11 system without dependencies. For IT security professionals, compliance teams, and system administrators working in Australian government or enterprise environments, automated Essential Eight auditing is a fundamental operational requirement.

The value isn't just in the compliance report — it's in the velocity. Running this audit manually would take an experienced admin 30-60 minutes per system. The script completes it in seconds and produces consistent, auditable results.

Built by ShadowStrike (Strategos) — where we build actual security tools instead of theatre 🎃.

How to Build a HaveIBeenPwned Breach Auditor in Python

ShadowStrike — Sun, 26 Apr 2026 11:32:30 +0000

Version 1.0.0

Data breaches happen constantly. When credentials from one breach get reused in credential-stuffing attacks against other services, the ripple effect can last years. That's why checking whether an email address or password has appeared in a known breach is a routine first step in any security assessment.

HaveIBeenPwned (HIBP) maintains one of the most comprehensive breach databases available, with over 12 billion compromised accounts indexed. In this tutorial, you'll build a Python CLI tool that checks email addresses and passwords against that database using the HIBP API, with proper k-anonymity implementation to protect privacy.

What You'll Build

A command-line Python tool called hibp_auditor.py that:

Checks passwords using k-anonymity (your password never leaves your machine) — works without any API key
Checks email addresses against the HIBP breach database (requires paid API subscription)
Handles API rate limiting gracefully
Outputs results to console and optionally to a timestamped report file

Note: Password checking is free and works immediately. Email breach checking requires a paid HIBP API subscription (pricing started ~2024).

Prerequisites

Python 3.6 or later
requests library (pip install requests)
No API key needed for password checking (uses k-anonymity)
Optional: Paid HIBP API subscription for email breach checking (haveibeenpwned.com/API/Key)

Understanding K-Anonymity

Before diving into code, it's worth understanding why password checking with HIBP is safe - because the implementation uses k-anonymity.

The problem: If you send your password to an API to check if it's compromised, you're... sending your password to an API. That's not great.

The solution: Instead of sending the full password, HIBP's Pwned Passwords API uses a clever technique:

You hash your password locally using SHA-1
You send only the first 5 characters of that hash to the API
The API returns all pwned password hashes that start with those 5 characters
You check locally whether your full hash is in that list

This means the API never sees your actual password or even your full hash. The first 5 characters of a SHA-1 hash match thousands of different passwords, so the API can't determine which specific password you're checking.

This is k-anonymity: your query is indistinguishable from k other possible queries, where k is large enough to preserve privacy.

The Complete Script

Here's the full implementation:

#!/usr/bin/env python3
"""
HaveIBeenPwned Breach Auditor
Purpose: Check email addresses and passwords against the HIBP breach database
Author: ShadowStrike (Strategos)
License: MIT
"""

import argparse
import hashlib
import requests
import sys
import time
from datetime import datetime

# HIBP API endpoints
HIBP_BREACH_API = "https://haveibeenpwned.com/api/v3/breachedaccount/{}"
HIBP_PASSWORD_API = "https://api.pwnedpasswords.com/range/{}"

def check_email_breaches(email, api_key=None):
    """
    Check if an email address appears in known data breaches.

    Args:
        email: Email address to check
        api_key: HIBP API key (required for email checks)

    Returns:
        List of breach dictionaries or None if error
    """
    if not api_key:
        print("[ERROR] Email breach checking requires an HIBP API key")
        print("[INFO] Get a free key at: https://haveibeenpwned.com/API/Key")
        return None

    url = HIBP_BREACH_API.format(email)
    headers = {
        'hibp-api-key': api_key,
        'user-agent': 'HIBP-Breach-Auditor'
    }

    try:
        response = requests.get(url, headers=headers, timeout=10)

        if response.status_code == 200:
            return response.json()
        elif response.status_code == 404:
            return []  # No breaches found (good news!)
        elif response.status_code == 429:
            print("[ERROR] Rate limit exceeded - wait and try again")
            return None
        else:
            print(f"[ERROR] API returned status code: {response.status_code}")
            return None

    except requests.exceptions.RequestException as e:
        print(f"[ERROR] Network error: {e}")
        return None

def check_password_pwned(password):
    """
    Check if a password appears in known breaches using k-anonymity.

    This uses the Pwned Passwords API with k-anonymity - only the first 5 
    characters of the SHA-1 hash are sent to the API, protecting privacy.

    Args:
        password: Password to check (never sent to API in plain text)

    Returns:
        Tuple of (is_pwned: bool, count: int) or (None, None) if error
    """
    # Hash the password locally
    sha1_hash = hashlib.sha1(password.encode('utf-8')).hexdigest().upper()

    # Send only the first 5 characters
    prefix = sha1_hash[:5]
    suffix = sha1_hash[5:]

    url = HIBP_PASSWORD_API.format(prefix)

    try:
        response = requests.get(url, timeout=10)

        if response.status_code == 200:
            # Parse the response - each line is "suffix:count"
            hashes = response.text.split('\r\n')

            for hash_line in hashes:
                if ':' in hash_line:
                    hash_suffix, count = hash_line.split(':')
                    if hash_suffix == suffix:
                        return (True, int(count))

            # Hash not found in response = password not pwned
            return (False, 0)

        elif response.status_code == 429:
            print("[ERROR] Rate limit exceeded")
            return (None, None)
        else:
            print(f"[ERROR] API returned status code: {response.status_code}")
            return (None, None)

    except requests.exceptions.RequestException as e:
        print(f"[ERROR] Network error: {e}")
        return (None, None)

def format_breach_info(breach):
    """Format a breach dictionary into readable output"""
    name = breach.get('Name', 'Unknown')
    domain = breach.get('Domain', 'N/A')
    breach_date = breach.get('BreachDate', 'Unknown')
    pwn_count = breach.get('PwnCount', 0)
    data_classes = ', '.join(breach.get('DataClasses', []))

    return f"""
  Breach: {name}
  Domain: {domain}
  Date: {breach_date}
  Accounts: {pwn_count:,}
  Data: {data_classes}
"""

def main():
    parser = argparse.ArgumentParser(
        description='Check email addresses and passwords against HaveIBeenPwned database',
        epilog='Example: python hibp_auditor.py --email test@example.com --api-key YOUR_KEY'
    )

    parser.add_argument('--email', type=str,
                        help='Email address to check for breaches')
    parser.add_argument('--password', type=str,
                        help='Password to check (uses k-anonymity - safe)')
    parser.add_argument('--api-key', type=str,
                        help='HIBP API key (required for email checks)')
    parser.add_argument('--output', type=str,
                        help='Write results to file (default: console only)')

    args = parser.parse_args()

    if not args.email and not args.password:
        parser.print_help()
        sys.exit(1)

    timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
    results = []
    results.append(f"HIBP Breach Audit Report - {timestamp}")
    results.append("=" * 60)
    results.append("")

    # Check email if provided
    if args.email:
        print(f"\n[*] Checking email: {args.email}")
        results.append(f"Email: {args.email}")

        breaches = check_email_breaches(args.email, args.api_key)

        if breaches is None:
            results.append("  Status: ERROR - Could not complete check")
        elif len(breaches) == 0:
            print("[OK] No breaches found - this email is clean!")
            results.append("  Status: CLEAN - No breaches found")
        else:
            print(f"[WARNING] Found in {len(breaches)} breach(es):")
            results.append(f"  Status: COMPROMISED - Found in {len(breaches)} breach(es)")
            results.append("")

            for breach in breaches:
                breach_info = format_breach_info(breach)
                print(breach_info)
                results.append(breach_info)

        results.append("")

        # Rate limiting courtesy
        if args.password:
            time.sleep(1.5)

    # Check password if provided
    if args.password:
        print(f"\n[*] Checking password (using k-anonymity)...")
        results.append("Password: [REDACTED]")

        is_pwned, count = check_password_pwned(args.password)

        if is_pwned is None:
            results.append("  Status: ERROR - Could not complete check")
        elif is_pwned:
            print(f"[WARNING] Password found in {count:,} breaches!")
            print("[ADVICE] This password is compromised - change it immediately")
            results.append(f"  Status: PWNED - Found in {count:,} breaches")
            results.append("  Advice: Change this password immediately")
        else:
            print("[OK] Password not found in known breaches")
            results.append("  Status: CLEAN - Not found in known breaches")

        results.append("")

    # Write to file if requested
    if args.output:
        try:
            with open(args.output, 'w', encoding='utf-8') as f:
                f.write('\n'.join(results))
            print(f"\n[*] Report written to: {args.output}")
        except IOError as e:
            print(f"\n[ERROR] Could not write to file: {e}")

    print("\n[*] Audit complete")

if __name__ == "__main__":
    main()

How to Use It

Installation

# Install dependencies
pip install requests


# Download the script
# (or clone from GitHub - link at end of tutorial)

# Linux/Mac only - make executable
chmod +x hibp_auditor.py

# Windows - no chmod needed, just run with python
python hibp_auditor.py --help

Security Note: Read the Code Before Running It

Before executing this or any Python script from the internet:

Read the source code completely — every function, every API call, every file operation
Verify the logic — does it do what it claims and nothing else?
Check for risks — unexpected network calls, file access, credential storage

Apply the ABC principle:

Assume nothing
Believe nothing
Check everything

Never execute code you haven't personally reviewed and understood, regardless of where it came from. You are the final security control.

Check a Password (No API Key Required)

python hibp_auditor.py --password "password123"

Sample output:

[*] Checking password (using k-anonymity)...
[WARNING] Password found in 2,254,650 breaches!
[ADVICE] This password is compromised - change it immediately

[*] Audit complete

Or with a strong password:

[*] Checking password (using k-anonymity)...
[OK] Password not found in known breaches

[*] Audit complete

Save Results to File

python hibp_auditor.py --email test@example.com --api-key YOUR_KEY --output report.txt

Check an Email Address (Requires Paid API Key)

Note: Email breach checking requires a paid HIBP API subscription. If you don't have an API key, the tool will show an error and direct you to the HIBP website.

python hibp_auditor.py --email test@example.com --api-key YOUR_API_KEY

Sample output (with valid API key):

[*] Checking email: test@example.com
[WARNING] Found in 3 breach(es):

  Breach: Adobe
  Domain: adobe.com
  Date: 2013-10-04
  Accounts: 152,445,165
  Data: Email addresses, Password hints, Passwords, Usernames

  Breach: LinkedIn
  Domain: linkedin.com
  Date: 2012-05-05
  Accounts: 164,611,595
  Data: Email addresses, Passwords

Code Walkthrough

Email Breach Checking

The check_email_breaches() function hits the HIBP API v3 endpoint:

url = HIBP_BREACH_API.format(email)
headers = {
    'hibp-api-key': api_key,
    'user-agent': 'HIBP-Breach-Auditor'
}
response = requests.get(url, headers=headers, timeout=10)

Key points:

Requires an API key (free for reasonable use)
Returns HTTP 404 if no breaches found (which we treat as good news)
Returns HTTP 429 if rate-limited (wait and retry)
Returns JSON array of breach objects if compromised

Password Checking with K-Anonymity

The check_password_pwned() function implements the k-anonymity protocol:

# Hash locally
sha1_hash = hashlib.sha1(password.encode('utf-8')).hexdigest().upper()

# Send only first 5 chars
prefix = sha1_hash[:5]
suffix = sha1_hash[5:]

url = HIBP_PASSWORD_API.format(prefix)
response = requests.get(url, timeout=10)

# Check if our full hash is in the response
for hash_line in hashes:
    hash_suffix, count = hash_line.split(':')
    if hash_suffix == suffix:
        return (True, int(count))

Why this is safe:

Password is hashed locally with SHA-1
Only the first 5 characters of the hash are sent
API returns ~500-1000 hash suffixes matching that prefix
We check locally if our full hash is in that list
The API never learns which specific hash we're checking

Rate Limiting Courtesy

The HIBP API has rate limits. The script implements courtesy delays:

if args.password:
    time.sleep(1.5)  # Wait between email and password checks

For production use checking multiple emails, implement exponential backoff when hitting 429 responses.

Real-World Use Cases

Small team audit: Check all company email addresses to see who's been compromised:

for email in alice@company.com bob@company.com charlie@company.com; do
  python hibp_auditor.py --email $email --api-key YOUR_KEY --output report_$email.txt
  sleep 2  # Rate limiting courtesy
done

Password policy enforcement: Check common weak passwords against HIBP before allowing them in your system:

is_pwned, count = check_password_pwned(user_password)
if is_pwned and count > 100:
    return "This password appears in known breaches - choose another"

Incident response: When investigating a suspected breach, check if credentials have appeared in public dumps:

python hibp_auditor.py --email suspicious@victim.com --api-key YOUR_KEY

Security awareness training: Demonstrate to users how common their passwords are:

python hibp_auditor.py --password "password123"
# Shows: "Found in 9,238,454 breaches!"

Extending the Script

Bulk email checking:
Add a --email-list parameter that reads from a CSV file and checks multiple addresses with proper rate limiting.

Domain-wide audit:
Integrate with your company directory (LDAP, Azure AD) to audit all @yourcompany.com addresses automatically.

Slack/Teams notifications:
Add webhook integration to alert security teams when compromised accounts are detected.

Password strength scoring:
Combine HIBP checking with zxcvbn or similar libraries to provide holistic password strength assessment.

MFA enforcement triggers:
Automatically enforce MFA for accounts found in breaches as part of your identity management workflow.

Security Considerations

Never log passwords: The script outputs [REDACTED] instead of the actual password in reports. Maintain this practice.

API key protection: Store your HIBP API key in environment variables, not hardcoded in scripts:

export HIBP_API_KEY="your-key-here"
python hibp_auditor.py --email test@example.com --api-key $HIBP_API_KEY

TLS verification: The requests library verifies TLS certificates by default. Don't disable this.

Rate limits: Respect HIBP's rate limits. They provide this service for free — don't abuse it.

GitHub Repository

The complete script, requirements.txt, and this tutorial are available on GitHub:

ShadowStrike-CTF / hibp-breach-auditor

A Python CLI tool to check email addresses against the HaveIBeenPwned breach database.

hibp-breach-auditor

A Python CLI tool to check email addresses against the HaveIBeenPwned breach database.

View on GitHub

Conclusion

Password reuse and credential stuffing remain among the most effective attack vectors in 2026. Building a simple Python CLI tool that checks against HaveIBeenPwned's database gives you a practical way to assess exposure for individuals or small teams.

The k-anonymity implementation means you can check passwords safely without ever transmitting them, and the email breach checking provides immediate visibility into which accounts need attention.

For security teams, incident responders, and IT administrators working with small-to-medium organisations, this is a foundational tool that costs nothing to run and provides immediate actionable intelligence.

Built by ShadowStrike (Strategos) — where we build actual security tools instead of theatre 🎃.

Why Diff Tools Lie: Detecting Hidden File Changes with PowerShell Hash Verification

ShadowStrike — Sun, 26 Apr 2026 11:05:53 +0000

Version 1.0.0

File modification detection sounds simple until you realise that timestamps can be forged, file sizes can stay identical while content changes, and simple diff tools often miss what matters most: the actual bytes.

If you work in IT security, digital forensics, compliance, or system administration, you need a way to verify file integrity that goes deeper than metadata. In this tutorial, you'll build a PowerShell script that creates cryptographic hash baselines of directories and detects modifications that other tools miss.

The Problem with Simple File Comparison

Most file comparison tools check three things:

File name
File size
Timestamp (created/modified)

An attacker with filesystem access can modify all three. A legitimate user editing a document might change content while the file size stays identical. A script running with admin privileges can alter files and reset timestamps to cover its tracks.

What doesn't lie: the cryptographic hash. Change a single bit in a multi-gigabyte file, and the SHA-256 hash changes completely.

What You'll Build

A PowerShell script called hash_verifier.ps1 with two modes:

Generate mode: Scans a directory, computes SHA-256 hashes for every file, and writes a baseline manifest to a timestamped .txt file.

Verify mode: Re-scans the same directory, compares current hashes against the baseline, and flags any files that have been modified, deleted, or added.

Prerequisites

PowerShell 5.1 or later (built into Windows 10 and above)
No external modules required - uses built-in Get-FileHash cmdlet
Read access to the directory you want to monitor

How It Works

The script uses PowerShell's Get-FileHash cmdlet, which computes cryptographic hashes using the SHA-256 algorithm. For each file in the target directory, it calculates a 256-bit hash value that uniquely represents that file's content.

Generate mode workflow:

Scan the directory (optionally recursing into subdirectories)
Compute SHA-256 hash for each file
Write hashes + file paths to a baseline manifest file
Store the manifest somewhere safe

Verify mode workflow:

Load the baseline manifest
Re-scan the directory and compute current hashes
Compare current hashes against baseline hashes
Report four categories: OK (unchanged), MISMATCH (modified), MISSING (deleted), NEW (added)

The Complete Script

Here's the full implementation:

# PowerShell File Hash Verifier
# Purpose: Generate hash baselines and detect file modifications
# Author: ShadowStrike (Strategos)
# License: MIT

param(
    [Parameter(Mandatory=$true)]
    [string]$Path,

    [Parameter(Mandatory=$true)]
    [ValidateSet("Generate","Verify")]
    [string]$Mode,

    [Parameter(Mandatory=$false)]
    [string]$Manifest = "",

    [Parameter(Mandatory=$false)]
    [string]$OutputDir = ".",

    [Parameter(Mandatory=$false)]
    [switch]$Recurse
)

# Ensure output directory exists
if (-not (Test-Path $OutputDir)) {
    New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
}

$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"

function Get-FileHashMap {
    param([string]$DirectoryPath, [bool]$RecurseSubdirs)

    $hashMap = @{}

    $files = if ($RecurseSubdirs) {
        Get-ChildItem -Path $DirectoryPath -File -Recurse -ErrorAction SilentlyContinue
    } else {
        Get-ChildItem -Path $DirectoryPath -File -ErrorAction SilentlyContinue
    }

    foreach ($file in $files) {
        try {
            $hash = Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction Stop
            $hashMap[$file.FullName] = $hash.Hash
        } catch {
            Write-Warning "Could not hash file: $($file.FullName)"
        }
    }

    return $hashMap
}

if ($Mode -eq "Generate") {
    Write-Host "[GENERATE MODE] Hashing files in: $Path" -ForegroundColor Cyan

    $hashMap = Get-FileHashMap -DirectoryPath $Path -RecurseSubdirs $Recurse

    $outputFile = Join-Path $OutputDir "HashVerifier_Generate_$timestamp.txt"

    $output = @()
    $output += "# Hash Baseline Generated: $(Get-Date)"
    $output += "# Path: $Path"
    $output += "# Recurse: $Recurse"
    $output += "# Total Files: $($hashMap.Count)"
    $output += ""

    foreach ($key in ($hashMap.Keys | Sort-Object)) {
        $line = "$($hashMap[$key])  $key"
        $output += $line
        Write-Host "[GENERATE] $key" -ForegroundColor Green
    }

    $output | Out-File -FilePath $outputFile -Encoding UTF8

    Write-Host "`n[COMPLETE] Manifest written to: $outputFile" -ForegroundColor Green
    Write-Host "[INFO] Use this file as -Manifest parameter in Verify mode" -ForegroundColor Yellow

} elseif ($Mode -eq "Verify") {
    if (-not $Manifest -or -not (Test-Path $Manifest)) {
        Write-Error "Verify mode requires a valid -Manifest file path"
        exit 1
    }

    Write-Host "[VERIFY MODE] Comparing current state against: $Manifest" -ForegroundColor Cyan

    # Load baseline hashes
    $baselineMap = @{}
    $manifestLines = Get-Content $Manifest | Where-Object { $_ -notmatch '^#' -and $_.Trim() -ne '' }

    foreach ($line in $manifestLines) {
        if ($line -match '^([A-F0-9]{64})\s{2}(.+)$') {
            $baselineMap[$matches[2]] = $matches[1]
        }
    }

    Write-Host "[INFO] Baseline contains $($baselineMap.Count) files" -ForegroundColor Yellow

    # Get current hashes
    $currentMap = Get-FileHashMap -DirectoryPath $Path -RecurseSubdirs $Recurse

    Write-Host "[INFO] Current directory contains $($currentMap.Count) files`n" -ForegroundColor Yellow

    $outputFile = Join-Path $OutputDir "HashVerifier_Verify_$timestamp.txt"
    $output = @()
    $output += "# Hash Verification Run: $(Get-Date)"
    $output += "# Baseline: $Manifest"
    $output += "# Path: $Path"
    $output += ""

    $okCount = 0
    $mismatchCount = 0
    $missingCount = 0
    $newCount = 0

    # Check for matches and mismatches
    foreach ($filePath in ($baselineMap.Keys | Sort-Object)) {
        if ($currentMap.ContainsKey($filePath)) {
            if ($currentMap[$filePath] -eq $baselineMap[$filePath]) {
                Write-Host "[OK]       $filePath" -ForegroundColor Green
                $output += "[OK] $filePath"
                $okCount++
            } else {
                Write-Host "[MISMATCH] $filePath" -ForegroundColor Red
                Write-Host "           Expected : $($baselineMap[$filePath])" -ForegroundColor Gray
                Write-Host "           Found    : $($currentMap[$filePath])" -ForegroundColor Gray
                $output += "[MISMATCH] $filePath"
                $output += "           Expected : $($baselineMap[$filePath])"
                $output += "           Found    : $($currentMap[$filePath])"
                $mismatchCount++
            }
        } else {
            Write-Host "[MISSING]  $filePath" -ForegroundColor Magenta
            $output += "[MISSING] $filePath"
            $missingCount++
        }
    }

    # Check for new files
    foreach ($filePath in ($currentMap.Keys | Sort-Object)) {
        if (-not $baselineMap.ContainsKey($filePath)) {
            Write-Host "[NEW]      $filePath" -ForegroundColor Yellow
            $output += "[NEW] $filePath"
            $output += "           Hash: $($currentMap[$filePath])"
            $newCount++
        }
    }

    $output += ""
    $output += "# Summary"
    $output += "# OK:       $okCount"
    $output += "# MISMATCH: $mismatchCount"
    $output += "# MISSING:  $missingCount"
    $output += "# NEW:      $newCount"

    $output | Out-File -FilePath $outputFile -Encoding UTF8

    Write-Host "`n[SUMMARY]" -ForegroundColor Cyan
    Write-Host "  OK:       $okCount" -ForegroundColor Green
    Write-Host "  MISMATCH: $mismatchCount" -ForegroundColor Red
    Write-Host "  MISSING:  $missingCount" -ForegroundColor Magenta
    Write-Host "  NEW:      $newCount" -ForegroundColor Yellow
    Write-Host "`n[COMPLETE] Report written to: $outputFile" -ForegroundColor Green
}

Troubleshooting: Execution Policy

If you see this error when first running the script:

.\hash_verifier.ps1 : File D:\hash_verifier.ps1 cannot be loaded. The file 
D:\hash_verifier.ps1 is not digitally signed. You cannot run this script on 
the current system.

This is PowerShell's execution policy blocking unsigned scripts. Fix it with these steps:

Step 1: Set RemoteSigned Policy

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

This allows locally-created scripts to run without digital signatures, while still requiring signatures for scripts downloaded from the internet.

Check your current policy:

Get-ExecutionPolicy -List

You should see CurrentUser showing RemoteSigned.

Step 2: Unblock the File (If Still Blocked)

If you still get the error even with RemoteSigned policy set, the file has been marked as "downloaded from the internet" by Windows. This happens when you download scripts from GitHub, copy files from certain locations, or create them with some text editors.

Unblock the file:

Unblock-File .\hash_verifier.ps1

Why this happens: Windows tags downloaded files with Zone.Identifier metadata. Even with RemoteSigned policy, Windows blocks these files unless they're digitally signed OR explicitly unblocked. The Unblock-File cmdlet removes this metadata flag.

Alternative: Bypass for Single Run (No Permanent Changes)

powershell -ExecutionPolicy Bypass -File .\hash_verifier.ps1 -Path "C:\ImportantFiles" -Mode Generate -OutputDir "C:\Baselines"

Good for one-off testing without changing system settings or unblocking files.

Security Note: Why This Script Isn't Digitally Signed

This script is deliberately not digitally signed. Here's why:

Code signing certificates cost $200-500/year from Certificate Authorities and require annual renewal. For open-source scripts where you can read the source code, transparency is more valuable than blind trust in a signature.

Before running ANY PowerShell script (including this one), you should:

Read the entire script — understand what it does, line by line
Verify the logic — does it do what it claims and nothing else?
Check for suspicious behaviour — network calls, registry modifications, file deletions outside stated scope

This is the ABC principle from British policing and serious crime investigation — formally codified in the ACPO Murder Investigation Manual (1998):

Assume nothing
Believe nothing
Check everything

A digital signature only tells you WHO wrote the code, not WHETHER the code is safe. You are the final verification step. Never execute code you haven't read and understood, regardless of where it came from or who signed it.

How to Use It

Step 1: Generate a Baseline

.\hash_verifier.ps1 -Path "C:\ImportantFiles" -Mode Generate -OutputDir "C:\Baselines"

This scans C:\ImportantFiles, computes SHA-256 hashes for every file, and writes the baseline to something like C:\Baselines\HashVerifier_Generate_20260424_153045.txt.

With recursion:

.\hash_verifier.ps1 -Path "C:\ImportantFiles" -Mode Generate -OutputDir "C:\Baselines" -Recurse

The -Recurse switch includes all subdirectories.

Step 2: Verify Against the Baseline

Wait some time (hours, days, weeks), then re-run in Verify mode:

.\hash_verifier.ps1 -Path "C:\ImportantFiles" -Mode Verify -Manifest "C:\Baselines\HashVerifier_Generate_20260424_153045.txt" -OutputDir "C:\Reports"

The script compares the current state against the baseline and writes a verification report to C:\Reports\HashVerifier_Verify_[timestamp].txt.

Understanding the Output

Generate mode writes a baseline file like this:

# Hash Baseline Generated: 24/04/2026 15:30:45
# Path: C:\ImportantFiles
# Recurse: False
# Total Files: 15

A1B2C3D4E5F6...  C:\ImportantFiles\document.docx
FF00AA11BB22...  C:\ImportantFiles\spreadsheet.xlsx

Each line contains a 64-character SHA-256 hash followed by the full file path.

Verify mode produces colour-coded console output:

[OK] (green) - File unchanged
[MISMATCH] (red) - Hash doesn't match baseline (file modified)
[MISSING] (magenta) - File was in baseline but no longer exists
[NEW] (yellow) - File exists now but wasn't in baseline

The verification report file contains the same information plus a summary count of each category.

Real-World Use Cases

Configuration management: Baseline critical system configuration files (C:\Windows\System32\drivers\etc\hosts, registry exports, GPO backups) and detect unauthorised changes.

Compliance auditing: Demonstrate to auditors that controlled documents haven't been altered between assessments.

Incident response: Establish known-good baselines for investigation machines, then verify they haven't been tampered with during analysis.

Change detection on network shares: Monitor shared directories for modifications, especially useful for detecting ransomware encryption in progress (files changing rapidly en masse).

Software deployment verification: After deploying application updates, verify that only expected files changed and nothing else was modified.

What This Detects That Other Tools Miss

Traditional file comparison tools check metadata. This script checks content.

Scenario 1: Timestamp forgery
An attacker modifies important.docx but resets the "Date Modified" timestamp to the original value using Set-ItemProperty. Windows Explorer shows no change. hash_verifier.ps1 detects the modification immediately because the content hash changed.

Scenario 2: Size-preserving edits
Someone edits a text file, deleting one character and adding another elsewhere. File size stays identical. hash_verifier.ps1 flags it as [MISMATCH] because even a single-bit change produces a completely different SHA-256 hash.

Scenario 3: File replacement
An executable is replaced with a different executable of the exact same size. Metadata looks normal. Hash verification catches it.

Performance Considerations

Hashing is CPU-intensive. On modern hardware:

Small files (< 1 MB): Nearly instant
Medium files (10-100 MB): 1-5 seconds each
Large files (1+ GB): Several seconds to minutes

For directories with thousands of files, generation takes time. Run it as a scheduled task during off-hours if monitoring production systems.

The verification step is typically faster than generation because PowerShell can skip re-hashing files if their metadata hasn't changed (though the script doesn't implement this optimisation for simplicity — it re-hashes everything to ensure accuracy).

Extending the Script

Email alerts on mismatch:
Add an if ($mismatchCount -gt 0) block that calls Send-MailMessage to alert administrators.

Scheduled task integration:
Create a Windows Scheduled Task that runs Verify mode daily and logs results to a central location.

SIEM integration:
Parse the output .txt file with a log ingestion tool and feed mismatch events into your security monitoring system.

Multi-algorithm verification:
Add MD5 or SHA-1 alongside SHA-256 for legacy compatibility or additional assurance (though SHA-256 alone is sufficient for integrity verification).

GitHub Repository

The complete script, sample baseline files, and this tutorial are available on GitHub:

ShadowStrike-CTF / powershell-hash-verifier

Automate file hash verification and mismatch detection with PowerShell.

powershell-hash-verifier

Automate file hash verification and mismatch detection with PowerShell.

View on GitHub

Conclusion

File integrity verification doesn't require expensive enterprise tools. PowerShell's built-in Get-FileHash cmdlet provides cryptographic-strength assurance that files haven't changed. This script packages it into a practical baseline-and-verify workflow that works on any Windows system without dependencies.

For IT security professionals, system administrators, and compliance teams working in Windows environments, hash-based file verification is a fundamental technique that catches modifications other tools miss.

Built by ShadowStrike (Strategos) — where we build actual security tools instead of theatre 🎃.

The 22-Second Problem: What Google Cloud NEXT '26's Agentic Defense Means for Essential Eight Compliance

ShadowStrike — Sat, 25 Apr 2026 02:23:32 +0000

This is a submission for the Google Cloud NEXT Writing Challenge

When Mandiant's M-Trends 2026 report revealed that the average time from initial intrusion to handoff to a secondary threat actor had collapsed from 8 hours to 22 seconds over three years, it confirmed what many security practitioners already suspected: traditional security operations aren't built for the speed of modern attacks.

Google Cloud NEXT '26's headline announcements—Agentic Defense, three new autonomous Security Operations agents, and the Wiz partnership—represent more than just another product launch. They signal a fundamental architectural shift in how organisations defend against threats. For Australian enterprises operating under the Australian Signals Directorate's Essential Eight framework, this shift raises an important question: does agentic security strengthen Essential Eight compliance, or does it create new gaps?

What Google Actually Announced

The core of Google's security story at NEXT '26 centres on Agentic Defense — the integration of Google Threat Intelligence, Security Operations, and Wiz's Cloud/AI Security Platform into a unified autonomous defence system.

Three new Security Operations agents entered preview:

-Threat Hunting Agent: Continuously analyses telemetry for anomalies and suspicious patterns

-Detection Engineering Agent: Automatically creates and refines detection rules based on emerging threats

-Third-Party Context Agent: Enriches alerts with external intelligence from vendor advisories and threat feeds

Alongside these, Wiz introduced red, blue, and green agents for continuous attack simulation, detection validation, and automated remediation across Google Cloud, AWS, Azure, and Oracle environments. The AI Application Protection Platform (AI-APP) extends code-to-cloud-to-runtime protection specifically for AI workloads.

The partnership also delivered Dark Web Intelligence (98% accuracy claimed in internal testing), AI-BOM (AI Bill of Materials for model transparency), and remote MCP server support for Google Security Operations.

The technical architecture is impressive. The strategic implications for compliance frameworks like Essential Eight are less obvious.

The Essential Eight Reality Check

Australia's Essential Eight mitigation strategies were designed around a simple principle: reduce the attack surface and contain damage when prevention fails. The framework mandates eight specific controls across three maturity levels (ML1, ML2, ML3), each with measurable technical requirements.

Let's examine how agentic security intersects with each:

Application Control (Mitigation Strategy 1)

Essential Eight ML3 requires that applications can only be executed from approved locations, all executables are validated against an approved list, and Microsoft's recommended application control policies are implemented.

Agentic security impact: Detection Engineering agents can identify unauthorised application execution patterns faster than human analysts, but they don't enforce allowlisting—that remains a GPO/Intune policy decision. Autonomous agents can alert on policy violations with sub-second latency; they cannot retroactively prevent execution that already occurred in those critical 22 seconds.

Compliance gap: Application control is preventative. Agentic detection is reactive, albeit extremely fast reactive. The two are complementary, not substitutional.

Patch Applications (Mitigation Strategy 2) & Patch Operating Systems (Mitigation Strategy 3)

ML3 mandates patching within 48 hours of release for internet-facing services and two weeks for other systems, with vulnerability scanning at least daily.

Agentic security impact: Wiz's green agent (automated remediation) can theoretically patch at machine speed, but Essential Eight compliance isn't measured by deployment speed—it's measured by patch coverage and risk prioritisation. An agent that patches every CVE indiscriminately creates operational risk; an agent that triages using threat intelligence aligns better with the framework's intent.
Google's Cloud Asset Inventory combined with Security Command Center's continuous vulnerability assessment does provide the "daily scanning" ML3 requires, and agent-assisted prioritisation could help meet the 48-hour window for critical patches.

Compliance opportunity: This is where agentic security genuinely strengthens Essential Eight posture—if organisations configure remediation agents to respect change management windows and business-critical system dependencies.

Multi-Factor Authentication (Mitigation Strategy 4)

ML3 requires phishing-resistant MFA (FIDO2, smart cards, Windows Hello for Business) for all users.

Agentic security impact: Minimal direct impact. MFA is an identity control; Security Operations agents operate in the detection/response layer. However, the Third-Party Context Agent can enrich MFA-related alerts (impossible travel, repeated failures) with threat intelligence that helps security teams identify credential compromise faster.

Compliance status: Unchanged. Essential Eight MFA requirements remain a policy and technology deployment challenge, not a detection problem.

Restrict Administrative Privileges (Mitigation Strategy 5)

ML3 requires privileged access workstations, just-in-time administration, separate privileged accounts, and strict segmentation.

Agentic security impact: Threat Hunting agents can detect privilege escalation attempts and lateral movement patterns that indicate compromised admin credentials, but they don't enforce least-privilege policies. Google Cloud's Agent Identity and Agent Gateway features (announced at NEXT '26) do provide governance for agent-to-agent communication and MCP server access—this is relevant because autonomous agents themselves represent a new privileged entity class.

Compliance consideration: Organisations need to treat Security Operations agents as privileged accounts. If an agent has read/write access to Security Command Center policies or can trigger automated remediation, it must be governed under Mitigation Strategy 5.

Regular Backups (Mitigation Strategy 6)

ML3 mandates daily backups, weekly testing of restoration, and offline/immutable storage.

Agentic security impact: None. Backups are an operational resilience control. Detection agents don't back up data; they detect ransomware encryption patterns. The green remediation agent could theoretically automate restoration workflows, but Essential Eight explicitly requires tested restoration—automated restore without validation doesn't satisfy ML3.

Compliance status: Unchanged.

Restrict Microsoft Office Macros (Mitigation Strategy 7)

ML3 requires that macros can only execute from trusted locations, all macros are digitally signed, and Microsoft's recommended macro security settings are enforced.

Agentic security impact: Detection Engineering agents can identify malicious macro execution (e.g., spawning PowerShell, making network connections), but macro execution restrictions are enforced by GPO, not by Security Operations tooling.

Compliance gap: Same pattern as Application Control—detection is reactive, policy is preventative.

User Application Hardening (Mitigation Strategy 8)

ML3 mandates web browser isolation, blocking ads/untrusted content, disabling Flash/Java, blocking web content from Office, and implementing DMARC/SPF/DKIM.

Agentic security impact: Browser isolation and content filtering are network/endpoint controls. Security Operations agents can detect policy violations (e.g., Flash execution, unvalidated email senders) but don't enforce the restrictions themselves.

Google's partnership with Wiz does provide Cloud/AI Security Platform capabilities that can monitor cloud-hosted applications for hardening policy drift, which is relevant for SaaS applications governed under Essential Eight.

Compliance status: Detection improves; enforcement remains a separate implementation concern.

The Real Question: Speed vs. Governance

The 22-second attacker handoff window is real. The idea that autonomous agents can respond faster than human analysts is also real. But Essential Eight compliance isn't measured by response time—it's measured by control implementation, coverage, and maturity level consistency.

Agentic security doesn't replace Essential Eight. It accelerates detection and response for Mitigation Strategies 1, 2, 3, 5, 7, and 8—but only if the underlying controls are already implemented. An organisation with no application control policies gains nothing from a Detection Engineering agent that can identify unauthorised execution in 22 seconds if the execution was never blocked in the first place.

The real value proposition is for organisations already at ML2 or ML3 maturity. These are the environments where:

Application control policies exist but drift occurs
Patch cycles are defined but threat prioritisation is manual
Privileged access is segmented but lateral movement detection is slow
Macro restrictions are enforced but evasion techniques evolve

For these organisations, Google's Agentic Defense becomes a force multiplier for existing controls. The Threat Hunting agent doesn't replace your application allowlist—it identifies when an attacker finds a bypass. The Detection Engineering agent doesn't replace your patch management workflow—it helps you prioritise which vulnerabilities are being actively exploited in the wild.

What Australian Enterprises Should Actually Do

If you're responsible for Essential Eight compliance in an organisation considering Google Cloud's security stack, here's the practical playbook:

1. Audit your current maturity level honestly.
If you're not at ML2 across all eight strategies, agentic security won't fix the gap. Implement the foundational controls first—application control, MFA, privilege restriction—then layer on autonomous detection and response.

2. Treat Security Operations agents as privileged accounts.
The Detection Engineering agent that can create custom detection rules has write access to your security posture. The green remediation agent that can auto-patch systems has administrative privileges. Both must be governed under Mitigation Strategy 5 (Restrict Administrative Privileges). Implement least-privilege principles, audit agent actions, and require multi-party authorisation for high-impact remediation workflows.

Map agent capabilities to Essential Eight evidence requirements. ASD's Essential Eight Maturity Model includes specific evidence requirements for each control. Can your Security Operations agents generate the logs, audit trails, and compliance reports ASD assessors expect? If not, manual evidence collection still applies—automation doesn't eliminate the compliance burden, it just shifts where the work happens.

4. Test autonomous remediation in non-production first.
Wiz's green agent can patch at machine speed. That's powerful. It's also dangerous if misconfigured. Essential Eight ML3 requires tested backups and change management processes. Autonomous remediation that breaks business-critical systems faster than humans can intervene creates operational risk that outweighs the 22-second response benefit.

5. Use Sydney-based Google Cloud regions for data sovereignty.
Google Cloud's Sydney and Melbourne regions have been operational since 2021. If you're subject to Australian data residency requirements (common in government and critical infrastructure), ensure Security Operations telemetry, Threat Intelligence data, and agent logs stay within Australian geography. The Google Cloud / Wiz partnership explicitly supports multicloud—verify that cross-cloud telemetry flows respect your jurisdiction requirements.

The Bigger Picture

Google Cloud NEXT '26's security announcements reflect a broader industry shift: security operations are moving from human-led, tool-assisted workflows to agent-led, human-supervised architectures. This isn't speculative—75% of Google's codebase is now AI-generated according to Sundar Pichai's keynote, and that same automation is coming to security operations.

For Essential Eight compliance, the question isn't whether to adopt agentic security. The question is how to adopt it without creating new compliance gaps.

The 22-second attacker handoff window is real, but so is the Essential Eight requirement for tested backups, validated patches, and auditable controls. Autonomous agents that respond in sub-second timeframes are impressive. Autonomous agents that can generate the evidence trail ASD assessors expect are essential.

The organisations that will succeed in this transition are those that treat agentic security as a compliance accelerant, not a compliance replacement. Implement the controls, deploy the agents to monitor and enforce them, audit the agents as privileged entities, and test everything before trusting automation in production.

And if you're still running Essential Eight at ML1, focus on the fundamentals first. No amount of autonomous threat hunting will compensate for missing application control policies or untested backups.

The 22-second problem is real. But the solution isn't just faster agents—it's faster agents operating within a mature security framework that treats speed and governance as complementary requirements, not competing priorities.

Have you implemented Essential Eight in your organisation? How are you thinking about autonomous security agents in a compliance-heavy environment? Let's discuss in the comments.

E-Waste Aware — Sanitise First, Then Recycle 🌏

ShadowStrike — Sat, 18 Apr 2026 05:19:33 +0000

This is a submission for Weekend Challenge: Earth Day Edition

What I Built

E-Waste Aware is a Flask web app that guides you through the responsible disposal of old tech — before it ends up in landfill leaching lead, mercury, and cadmium into the soil for decades.

The tool has two parts that work together. First, a device-specific data sanitisation checklist — because handing over a device that still has your accounts, passwords, and personal files on it is a security problem as much as an environmental one. Second, a curated guide to Australian recycling programs for that device type, with direct links to drop-off locations.

Six device types are covered: laptops, smartphones, hard drives and SSDs, tablets, printers, and monitors. Each has its own sanitisation steps and relevant programs like TechCollect, MobileMuster, and Cartridges 4 Planet Ark.

The checklist is interactive — tick off each step as you go, watch the progress bar fill, and get a confirmation banner when your device is ready for recycling. Clean, no account required, no data collected.

Demo

Code

ShadowStrike-CTF / ewaste-aware

A Flask web app for responsible e-waste disposal — sanitise your device first, then find the right Australian recycling program.

E-Waste Aware 🌏

A Flask web app that guides you through responsible disposal of old tech — sanitise first, then recycle.

Built for the DEV Community Weekend Challenge: Earth Day Edition 2026 by ShadowStrike (Strategos).

What This Does

Most e-waste guides jump straight to "here's where to drop it off." This tool does the step before that — because a device with your accounts still active, your files still intact, and your passwords still saved is not ready to hand to a stranger.

E-Waste Aware covers two things for each device type:

Sanitisation checklist — step-by-step data wiping instructions specific to your device, with an interactive tick-off and progress tracker
Australian recycling programs — curated drop-off options with direct links

Devices Covered

💻 Laptop
📱 Smartphone
💾 Hard Drive / SSD
📲 Tablet
🖨️ Printer
🖥️ Monitor / TV

Installation

pip install flask
python app.py

Then open http://127.0.0.1:5000 in your…

View on GitHub

How I Built It

The stack is deliberately minimal — this is a tool, not a framework showcase.

Python 3 + Flask for routing and template rendering
Jinja2 templates for the two-page flow (device selection → disposal guide)
Vanilla JavaScript for the interactive checklist state (no dependencies)
Google Fonts (Syne + DM Mono) for the UI typography
Single requirements.txt with one dependency: flask>=3.0.0

The device data lives in a Python dictionary in app.py — sanitisation steps, environmental impact stats, and recycling program details all keyed by device type. Keeping it in one place makes it easy to update as programs change or new devices are added.

The design leans into an earthy, organic aesthetic that feels appropriate for an Earth Day tool without being generic. Dark soil tones, forest green accents, and a noise texture overlay give it atmosphere without weighing down the load time.

The sanitisation-first angle was a deliberate decision. Most e-waste tools jump straight to "here's where to drop it off" — but a device with your Apple ID still active, your Google account still signed in, or your files still intact is not ready to hand to a stranger. The security layer is the differentiator here, and it's something every person who's worked in IT or digital forensics will immediately appreciate.

I Built a Security Tool That Does Absolutely Nothing (And It's Terrifyingly Realistic)

ShadowStrike — Sun, 12 Apr 2026 04:07:28 +0000

This is a submission for the DEV April Fools Challenge

What I Built:
I built the IT Security Theatre Simulator - a Python command-line tool that perfectly replicates enterprise security software by doing all the impressive-looking theatre with none of the actual security. It scans for "residual quantum entanglement in TCP packets," generates CRITICAL findings like "CEO's password is strong (this breaks our revenue model)," recommends you "implement zero-trust architecture for your office printer network," and produces final reports showing you prevented exactly zero threats while generating substantial vendor revenue.
If you have ever sat through a security vendor demo, you will recognise every single pattern in this tool. The unnecessarily long progress bars, the suspiciously precise statistics, the CRITICAL alerts about nothing, the useless recommendations - all of it is brutally accurate satire.

Demo:

Code:

ShadowStrike-CTF / security-theatre-simulator

IT Security Theatre Simulator - A devastating satire of enterprise security tools built for DEV April Fools Challenge 2026

IT Security Theatre Simulator 🎭

A devastating satire of enterprise security tools that generate impressive reports with zero actual value.

Built for the DEV Community April Fools Challenge 2026 by ShadowStrike (Strategos).

What This Does

This tool perfectly simulates enterprise security software by:

Taking way too long to do absolutely nothing
Displaying impressive progress bars that measure fictional work
Generating CRITICAL findings about non-existent threats
Providing completely useless recommendations
Creating reports with suspiciously precise but meaningless statistics
Looking professional enough that executives might actually buy it

Installation

Option 1: With pretty colours (recommended)

pip install colorama
python security_theatre.py

Option 2: Without colours (it still works, just less theatrical)

python security_theatre.py

Usage

python security_theatre.py

Then sit back and enjoy the show. Press ENTER when prompted to begin the security theatre performance.

Sample Output

CRITICAL: Detected 47 instances of employees understanding security policy
CRITICAL: Security team found implementing practical solutions
SEVERE: CEO's

…

View on GitHub

How I Built It:
The entire tool is about 350 lines of Python built in roughly 2 hours. The technical stack is deliberately simple because the whole point is that this does nothing complicated:

-Python 3 for the core logic
-colorama for terminal colours that make it look impressively official
-time.sleep() for dramatic pauses that simulate "work" being done
-random module to select different combinations of fake threats and scans each run

The architecture consists of collections of absurd security scans, CRITICAL threats, and useless recommendations that get randomly selected and displayed with realistic-looking progress bars and timing. Every element is designed to mirror real enterprise security tools - the slow scanning, the precise but meaningless statistics, the urgent language around non-existent problems.

The funniest part of building this was realising that the fake scans I wrote ("analysing deprecated legacy future-proofing configurations") sound exactly like real security tool marketing copy. The line between satire and reality is uncomfortably thin.

Prize Category:
Community Favourite - I am targeting this one because every single person who works in IT or cybersecurity will instantly recognise these patterns and laugh at how accurate the satire is. Security theatre is a universal experience in our industry, and this tool captures it perfectly.