Selected work
PostureKit
Make configuration observations inspectable, from collection to a reviewable evidence trail.
PUBLIC TOOL / Windows · identity · network posture
PostureKit is an evidence-led toolkit for authorized Windows and network posture assessment. Its public documentation describes a collector, integrity manifests, deterministic rules and adjacent importers. It identifies configuration observations; an analyst decides their significance.
This portfolio describes its purpose. Current support and behavior belong to the versioned source and documentation.
Open the public repositoryThe problem
A configuration verdict is difficult to defend when its source is missing. A useful assessment should show what was collected, how it was evaluated, and where the observation stops.
The approach
Collect a declared set of facts from authorized systems, retain evidence references and hashes, and analyze the resulting batch through explicit rules. Missing or unavailable observations remain distinguishable from a passing check.
What to inspect
Start with the project README and its synthetic offline demonstration. Review the supported platforms, collection requirements, scope rules and documented limitations before any real environment is involved.
Boundaries
Hashes support comparison against a trusted reference; they do not authenticate a reference replaced alongside the evidence. Configuration review is not proof of exploitability, complete coverage or overall security.