Machine learning is now embedded throughout the detection pipeline, where it faces an adversary who is aware of it and motivated to defeat it. This paper examines the attack surface…
Attribution remains one of the least automated functions in security operations. This paper examines why, surveys the representations and methods available for machine-assisted attribution, and proposes an evaluation framework that…
Containers are not a security boundary in the way most teams assume. Understanding what isolates a container — and what does not — determines whether one compromised pod is contained…
APIs fail differently from web applications. The dominant vulnerabilities are not injection flaws — they are authorisation flaws, and no scanner can find them because only your business logic knows…
Scanners find bugs in code. They cannot find a flaw in your design, because the code implements the flaw perfectly. Threat modelling is the only practice that catches problems no…
Endpoint telemetry stops at the devices you manage. Network data covers everything that talks, including the printer, the contractor's laptop and the appliance nobody can install an agent on.
Cloud providers run some of the best-defended infrastructure on earth, and cloud breaches remain routine. Almost none of them are the provider's fault — they happen in the half of…
You can write flawless code and still ship a backdoor. Modern applications are assembled from thousands of components you did not write, built by pipelines with more privilege than most…
Most multi-factor authentication stops password reuse and nothing else. If a user can read a code and type it somewhere, an attacker can ask them to. The distinction between MFA…
Hunting is not staring at dashboards waiting for something to look wrong. It is a structured search for activity your detections were never built to catch — and every hunt…