Infrastructure post-mortems. What actually broke, reconstructed from the real incident reports.https://trustboundarystudio.com/en-auhttps://trustboundarystudio.com/avatar.pnghttps://trustboundarystudio.com/360https://trustboundarystudio.com/posts/capital-one-2019/https://trustboundarystudio.com/posts/capital-one-2019/Everyone remembers the server-side request forgery. The regulator's findings never mention it. What the OCC actually penalised was risk assessment and internal audit.Wed, 09 Sep 2026 00:00:00 GMTCapital One, 2019Capital OneSSRFIMDSv2AWS IAMleast privilegeOCC consent ordercloud misconfiguration