Analysis from active engagements, position papers, and practical guidance — written by the practitioners who do the work, not by a marketing team.
Ransomware affiliates are pooling tooling, reinvesting ransoms into zero-day acquisition, and weaponising LLMs. A practitioner's read on what's changing and what it means for IR.
AI-generated narrative has started to appear in DFIR reports without analyst attribution. Why that fails in court, and how Makkari uses AI without inheriting the problem.
The trend nobody's watching: the shrinking dwell time of double-extortion operators. What it means for your detection window, your MDR, and your retainer.
ICO and EU supervisory authorities are asking harder technical questions. A field note on the gaps that most commissioned forensic reports still leave open.
Primary refresh tokens, device-code phishing, OAuth abuse. A non-vendor view of what post-auth identity attack actually looks like on the wire.
Why "we patched 2,400 CVEs this quarter" is a vanity metric, and what a proper exposure programme reports to the board instead.
Full articles coming shortly — subscribe below to be notified.
Short, technical, useful. Unsubscribe in one click. We don't sell lists.