Security is a habit, not a setup

The course ends here. Your system does not. Every answer you got from the prompts in lessons 0 to 8 was true on the day you ran them, and that day is already behind you.

What drifts

• Keys accumulate. Each new service you connect adds one, and nobody removes the old ones (lesson 4)
• Packages change under you. The thing you installed and read six months ago has had twenty releases since, and you read none of them (lesson 5)
• Agents get new reach. A connector added for one task stays on for every task after it, and an agent that held two legs of the Rule of Two now holds three (lesson 3)
• The world moves. A service that holds your keys or your data gets breached, and it may or may not tell you

The test you ran in lesson 8 measured your system on one day. A month later it is a different system.

Breaches happen to the services you use, not only to you

Most people learn about a breach from the news, weeks after the fact, if at all. You do not have a security team watching for it. The replacement is a short list and a habit: which services hold my keys, which hold other people's data on my behalf, and once a month, has any of them reported an incident? There are free notification services that will email you when an address of yours shows up in a known breach. Use one. When a service on your list makes the news, assume the keys you gave it are exposed, revoke them at the issuer and issue new ones. Do not wait for the service to tell you it was your account.

A date and a log

Pick a day. The first of the month, the Sunday after payday, whatever you will actually keep. Monthly is right for most people who run a few agents. Quarterly is too rare: that is three months of drift before you look.

Keep a log, and let the agent write it. Lesson 7 asked for one line per outbound action, which is the daily record. This is the monthly one: a dated entry with what changed, what you decided and what you skipped. The log is what turns the next review from a memory exercise into a comparison. Without it, every review starts from zero and finds the same five things.

Rerun the course on yourself

The checklist page on this site is the printed version of this habit. Twice a year, rerun the inventory from lesson 0 and the canary test from lesson 8, because those two are the ones that measure your system rather than describe it.

Nobody does all of this, and nobody should pretend to. The point of the review is to pick the one thing that most needs moving this month and move it. Next month, pick the next one. A year of that is a system that improved twelve times, which is more than most companies with a security team can say.

What I do on a schedule

Everything above, was what my security agent suggested and wrote.

Here's what I do in practice in my own system today:

• Weekly: Track files and workflows for secrets, clean up allow permissions
• Monthly: Sort automation lint's exfiltration-shape and prompt-injection flags, look and clean broken credentials
• Monthly: Reads security feeds, see what needs to be "converted" into security skills
• Every 3 months: Check the authority registry against the real system
• Every 3 months: Skills maintenance - scan before upgrading incoming changes
• Every 3 months: Check the audit log of my sites
• Every 3 months: Refresher on latest OWASP ID issues, reading reputable security sites for updates
• Every 3 months: Agents conduct a security games, checking protections and security actions (such as access-removal drill)
• Every 6 months: Look at money and data surfaces and the threat model built for them
• Every 12 months: Review static sites and small services

And yes, all the above belongs to a dedicated security agent that I have in my system.

Run my monthly security review.

Keep a file called security-log.md in my workspace with one dated entry per run, and compare against the previous entry if there is one.

List:
1. every agent, routine, key, package or connected tool that was added or changed since the last entry
2. which packages and tools have an update I have not installed
3. which of the services that hold my keys or my data reported a breach or a security incident since the last entry, and what I should do about it
4. which keys were not used in the last 90 days, so I can revoke them
5. whether my backup was restored from since the last entry

Where you cannot check something, say so in the entry instead of guessing.

End with the three items most worth doing this month, and write the entry to the file before you tell me anything.