All Posts

12 posts — filter by category, tag, or difficulty

Category:

Difficulty:

Tags:

Identity-First Attacks: The Kill Chain Defends Five Stages the Attacker Skips

The 2011 kill chain trains you to stop malware at the perimeter. Identity-first attackers skip five of its seven links and log in. What to defend instead.

May 15, 2026 · 15 min read

#identity #threat-landscape #cloud #lateral-movement

tooling advanced

NHI Security in 2026: The Category Is Consolidating Before It Learned to Detect

A detection engineer's map of the NHI vendor landscape — and why it's being acquired into platforms before it built the part that catches breaches.

May 10, 2026 · 19 min read

#nhi #identity #landscape #research

threat intel advanced

Detecting Prompt Injection in Production: Watch the Trifecta Close, Not the Prompt

Prompt injection is OWASP's #1 LLM risk and you can't filter it out. Stop detecting the prompt — detect the lethal trifecta closing in one session.

May 5, 2026 · 17 min read

#ai-security #prompt-injection #llm #ai-agents

threat intel advanced T1552.005

Workload Identities Have a Home Address — So Watch Where They Get Used

Cloud hands every workload a privileged identity by default. Unlike other machine identities it's bound to one host — use from elsewhere is theft.

Apr 20, 2026 · 12 min read

#nhi #workload-identity #cloud #sigma

threat intel advanced

AI Agents as Attack Surface: Detect the Action, Not the Prompt

An AI agent is a non-human identity with an opaque decision layer. You can't detect the prompt injection — so watch what the agent's credential does.

Apr 15, 2026 · 14 min read

#ai-agents #ai-security #llm #prompt-injection

threat intel advanced T1528

OAuth Abuse in SaaS: The Attack Moved to the Authorization Layer — Your Detection Didn't

OAuth abuse bypasses MFA by attacking authorization, not authentication. Most SOCs don't collect consent-grant telemetry — here's what to detect.

Apr 10, 2026 · 11 min read

#identity #oauth #saas #sigma

threat intel advanced T1098

Identity Creep: You'll Never Reach Least Privilege, So Instrument the Blast Radius

92% of identities are over-permissioned and creep leaves no log line. Stop treating the blast radius as cleanup — instrument it instead.

Apr 5, 2026 · 12 min read

#identity #nhi #detection-program #iam

threat intel intermediate

Your Threat Intel Program Is Measuring the Wrong Thing

Most CTI programs measure IOCs ingested and reports published — activity, not effect. Here's what operationalized intelligence actually looks like.

Mar 30, 2026 · 9 min read

#hot-take #threat-intel #CTI #detection-program

detection engineering advanced

Detection-as-Code Is Not About Git: Building a Program That Scales Without You

Most teams 'do DaC' by putting Sigma in a repo. That's the easy 20%. The capability that scales is a tested lifecycle, not a toolchain.

Mar 20, 2026 · 13 min read

#detection-as-code #sigma #detection-program #ci-cd

threat intel intermediate T1078.004

45 to 1: Non-Human Identities Are Your Biggest Detection Blind Spot

You have ~45 non-human identities per human — and the signals your detection runs on (MFA, impossible travel, login geo) don't exist for any of them.

Mar 15, 2026 · 17 min read

#nhi #identity #cloud #ai-agents

detection engineering advanced T1621

Alert Fatigue Is an Offensive Technique, Not a Tuning Problem

MFA fatigue has a MITRE technique ID. SOC alert flooding doesn't — same deliberate tactic, different target, and why your defenses keep failing.

Mar 10, 2026 · 14 min read

#hot-take #detection-program #threat-landscape #defense-evasion

detection engineering advanced

The Detection Funnel: How Your 80% ATT&CK Coverage Becomes a 6% Catch Rate

ATT&CK coverage % looks good in board decks. Here's why it compounds into a ~6% actual catch rate — and what Threat Detection Coverage actually means.

Mar 5, 2026 · 11 min read

#hot-take #metrics #detection-program #coverage