All Posts

20 posts — filter by category, tag, or difficulty

Category:

Difficulty:

Tags:

Ransomware in 2026: Encryption Is the Last Step. Detect the Four That Come Before It

The encryptor is the terminal event, not the attack. Detection didn't vanish when breakout hit 29 minutes. It relocated to the pre-encryption phases.

Jun 6, 2026 · 16 min read

#ransomware #threat-landscape #sigma #detection-program

tooling advanced

CTEM: Real Security Program or Vendor Rebrand?

CTEM is not new, the integration is genuinely valuable, and the 'CTEM platform' is mostly rebranded BAS/ASM/RBVM. Buy the operating model, not the acronym.

Jun 4, 2026 · 14 min read

#hot-take #landscape #detection-program

siem advanced

AI in the SOC: Are We Building Analysts or Renting Their Judgment?

The de-skilling fear has a long track record, and it usually turns into upskilling. Whether AI does that for your SOC is a deployment choice, not fate.

Jun 2, 2026 · 16 min read

#ai-security #hot-take #detection-program #career

incident response advanced

Cloud Lateral Movement: The Techniques Your SOC Keeps Missing

Lateral movement moved to the cloud control plane. Each hop is individually authorized, so single-event rules miss the chain.

May 30, 2026 · 16 min read

#cloud #lateral-movement #sigma #detection-program

detection engineering advanced

Your Board Doesn't Care About T1078: A Detection Coverage Model in the Language of Business Risk

216 technique IDs are not a decision surface. Translate detection coverage into named threats against crown-jewel assets, in dollars, with drill-down.

May 25, 2026 · 16 min read

#metrics #detection-program #coverage #leadership

detection engineering advanced T1218

Living Off the Land in 2026: Stop Detecting the Binary, Detect the Chain

LOTL didn't add binaries. It commoditized chaining and moved to where EDR can't run. Stop detecting the binary. Detect the chain.

May 20, 2026 · 15 min read

#lolbas #sigma #detection-program #threat-landscape

threat intel advanced T1078

Identity-First Attacks: The Kill Chain Defends Five Stages the Attacker Skips

The 2011 kill chain trains you to stop malware at the perimeter. Identity-first attackers skip five of its seven links and log in. What to defend instead.

May 15, 2026 · 14 min read

#identity #threat-landscape #cloud #lateral-movement

tooling advanced

NHI Security in 2026: The Category Is Consolidating Before It Learned to Detect

A detection engineer's map of the NHI vendor landscape, and why it's being acquired into platforms before it built the part that catches breaches.

May 10, 2026 · 18 min read

#nhi #identity #landscape #research

threat intel advanced

Detecting Prompt Injection in Production: Watch the Trifecta Close, Not the Prompt

Prompt injection is OWASP's #1 LLM risk and you can't filter it out. Stop detecting the prompt. Detect the lethal trifecta closing in one session.

May 5, 2026 · 17 min read

#ai-security #prompt-injection #llm #ai-agents

detection engineering advanced

MTTD Is a Lagging Indicator You Can Game to Zero

MTTD and dwell time only exist after a breach and reward alert volume. Keep them as the board scoreboard; steer your program on leading indicators.

Apr 30, 2026 · 15 min read

#metrics #detection-program #hot-take

detection engineering advanced

Your CI/CD Pipeline Is an Unmonitored Production Environment

XZ, tj-actions, Shai-Hulud, Codecov all owned the build, not the code. Scanning is blind to a poisoned build in flight. Detect the runner instead.

Apr 25, 2026 · 16 min read

#supply-chain #ci-cd #sigma #detection-program

threat intel advanced T1552.005

Workload Identities Have a Home Address, So Watch Where They Get Used

Cloud hands every workload a privileged identity by default. Unlike other machine identities it's bound to one host. Use from elsewhere is theft.

Apr 20, 2026 · 12 min read

#nhi #workload-identity #cloud #sigma

threat intel advanced

AI Agents as Attack Surface: Detect the Action, Not the Prompt

An AI agent is a non-human identity with an opaque decision layer. You can't detect the prompt injection, so watch what the agent's credential does.

Apr 15, 2026 · 13 min read

#ai-agents #ai-security #llm #prompt-injection

threat intel advanced T1528

OAuth Abuse in SaaS: The Attack Moved to the Authorization Layer. Your Detection Didn't

OAuth abuse bypasses MFA by attacking authorization, not authentication. Most SOCs don't collect consent-grant telemetry. Here's what to detect.

Apr 10, 2026 · 11 min read

#identity #oauth #saas #sigma

threat intel advanced T1098

Identity Creep: You'll Never Reach Least Privilege, So Instrument the Blast Radius

92% of identities are over-permissioned and creep leaves no log line. Stop treating the blast radius as cleanup. Instrument it instead.

Apr 5, 2026 · 12 min read

#identity #nhi #detection-program #iam

threat intel intermediate

Your Threat Intel Program Is Measuring the Wrong Thing

Most CTI programs measure IOCs ingested and reports published: activity, not effect. Here's what operationalized intelligence actually looks like.

Mar 30, 2026 · 9 min read

#hot-take #threat-intel #CTI #detection-program

detection engineering advanced

Detection-as-Code Is Not About Git: Building a Program That Scales Without You

Most teams 'do DaC' by putting Sigma in a repo. That's the easy 20%. The capability that scales is a tested lifecycle, not a toolchain.

Mar 20, 2026 · 13 min read

#detection-as-code #sigma #detection-program #ci-cd

threat intel intermediate T1078.004

45 to 1: Non-Human Identities Are Your Biggest Detection Blind Spot

You have ~45 non-human identities per human, and the signals your detection runs on (MFA, impossible travel, login geo) don't exist for any of them.

Mar 15, 2026 · 16 min read

#nhi #identity #cloud #ai-agents

detection engineering advanced T1621

Alert Fatigue Is an Offensive Technique, Not a Tuning Problem

MFA fatigue has a MITRE technique ID. SOC alert flooding doesn't. Same deliberate tactic, different target, and why your defenses keep failing.

Mar 10, 2026 · 14 min read

#hot-take #detection-program #threat-landscape #defense-evasion

detection engineering advanced

The Detection Funnel: How Your 80% ATT&CK Coverage Becomes a 6% Catch Rate

ATT&CK coverage % looks good in board decks. Here's why it compounds into a ~6% actual catch rate, and what Threat Detection Coverage actually means.

Mar 5, 2026 · 11 min read

#hot-take #metrics #detection-program #coverage