Detection & Response Engineer @ Meta | DEF CON & fwd:cloudsec Speaker | OSCE3 | 200+ Research Citations
Schrödinger's Detection: a detection is unproven until it is measured. This blog tests detections the way they actually run in production, and the recurring Measured Detection series reports the numbers.
// searchable detection corpus
57,596 detection rules from 25 sources, MITRE ATT&CK mapped and updated daily.
// ai attack & defend
A section of the lab, not a separate product. It covers AI security in both directions, and its measurements feed the quarterly series on AI attack coverage in the public rule corpus.
How AI systems are attacked, and how to detect and prevent it: prompt injection, agent hijacking, model theft, data poisoning. Grounded in a curated dataset of 40 AI attacks mapped to MITRE ATLAS.
How autonomous agents attack at machine speed, and how to detect and respond at the same pace: AI-autonomous compromise at non-human identity scale, where human triage queues do not keep up.
57,602 rules across 25 public repos: where content is growing, where ATT&CK coverage breaks down, and why raw counts deceive.
216 technique IDs are not a decision surface. Translate detection coverage into named threats against crown-jewel assets, in dollars, with drill-down.
An AI agent is a non-human identity with an opaque decision layer. You can't detect the prompt injection, so watch what the agent's credential does.
You have ~45 non-human identities per human, and the signals your detection runs on (MFA, impossible travel, login geo) don't exist for any of them.
ATT&CK coverage % looks good in board decks. Here's why it compounds into a ~6% actual catch rate, and what Threat Detection Coverage actually means.
SIGMA rules, detection logic, alert tuning
IOCs, TTPs, actor profiles, intel feeds
Playbooks, triage guides, forensics
Static/dynamic analysis, YARA rules
KQL, SPL, EQL — platform-specific content
Step-by-step guides for all levels
Get detection rules, threat intel, and tutorials delivered to your inbox.
No spam. Unsubscribe any time.