SOC analysis, threat intelligence research, security tools, and experimental projects — all from the frontlines of cyber defense.
Machine learning is now embedded throughout the detection pipeline, where it faces an adversary who is aware of it and motivated to defeat it. This paper examines the attack surface…
Read full paper →Attribution remains one of the least automated functions in security operations. This paper examines why, surveys the representations and methods available for machine-assisted attribution, and proposes an evaluation framework that…
Read full paper →Containers are not a security boundary in the way most teams assume. Understanding what isolates a container — and what does not — determines whether one compromised pod is contained…
Read full paper →APIs fail differently from web applications. The dominant vulnerabilities are not injection flaws — they are authorisation flaws, and no scanner can find them because only your business logic knows…
Read full paper →Scanners find bugs in code. They cannot find a flaw in your design, because the code implements the flaw perfectly. Threat modelling is the only practice that catches problems no…
Read full paper →Endpoint telemetry stops at the devices you manage. Network data covers everything that talks, including the printer, the contractor's laptop and the appliance nobody can install an agent on.
Read full paper →20+ browser-based security and developer tools, built from scratch — JWT, CVSS, subnet, regex, hashing, a from-scratch QR encoder and more. 100% client-side.
Research into using machine learning and NLP to automate attributing intrusions to the threat actors behind them.
A growing library of practitioner write-ups mapping defences to MITRE ATT&CK — ransomware anatomy, account-takeover detection, static malware triage.
The custom platform behind this site — a bespoke WordPress theme, a client-side tool engine, and the content system powering the research and toolkit.
A lab that reveals the signals your browser leaks — canvas, WebGL, fonts, timezone — and hashes them into a single fingerprint, entirely locally.
A Wordle-inspired word puzzle built as a browser experiment, with daily challenges, custom games, a practice mode, leaderboards and hints. It runs entirely in the…
Paste raw email headers to trace how a message actually travelled and whether it is authentic. The parser…
Analyse a suspicious link for phishing red flags without ever visiting it. The scanner inspects the structure of…
Check how strong a password really is and whether it has already appeared in a known data breach.…
Decode a JWT and inspect its claims — 100% client-side; the signature is never verified or transmitted.
Compute a CVSS v3.1 Base score, severity, and vector string — 100% client-side.
IPv4 CIDR / subnet calculator — network, broadcast, host range, masks and counts, fully offline.
Generate strong passwords or passphrases with live entropy — 100% client-side.
Live regex tester with match highlighting and capture groups — 100% client-side.