Field notes, threat analysis and long-form guidance from the people doing the work. Published as we learn it.
VMware ESX systems are a recurring target in ransomware campaigns. Threat groups including SCATTERED SPIDER, BlackBasta, Royal (aka BlackSuit) and Akira lean on the same handful of obfuscation tricks — here is how to hunt them.
The conversation about AI in cybersecurity has centered on capabilities like vulnerability discovery, exploit generation and automated proof-of-concept development. That framing leaves most of the defensive surface unmeasured.
As autonomous agentic systems take on more critical operations inside corporate boundaries, securing the execution harness against untrusted agent actions is the new frontier of enterprise risk mitigation.
Most quarterly risk reporting optimizes for completeness. Boards optimize for decisions. Three structural changes that close the gap without adding a reporting cycle.
We instrumented eighteen months of tier-one response across four mid-market SOCs. Automation cut volume, but only the playbooks with explicit rollback paths held up under real incidents.
A regulated manufacturer with a decade-old flat network needed segmentation before an audit. The phased path we ran, the two things that went wrong, and what it cost.
MCP servers sit between an assistant and your data with very little between them. Treat each one as an unauthenticated integration until proven otherwise.
Detections decay. Teams that version, test and deprecate them like software keep their true-positive rate flat as the estate grows; teams that do not, do not.
Vendor questionnaires assume software behaves the same way twice. Agentic vendors break that assumption — a revised diligence framework for procurement and security to run together.
A constant mix of student and faculty devices made the attack surface unknowable. Passive discovery plus enrollment nudges got coverage from an estimated 40% to 94% in one semester.