Posts
When the Agent Is the Incident: NIST, NSA, and CISA's 10 Key Practices for SI Incident ResponseEvery incident response playbook you’ve ever written assumes the same cast. There’s an attacker, …
// Latest Intelligence
Recent Posts
Posts
PHP2Shell: What We Know About CVE-2026-109618 and CVE-2026-109619, and What to Do TodayOn October 20, two critical vulnerabilities in PHP core leaked a day before their planned disclosure. They’re …
Posts
The SOC Gets a New Org Chart: Five Security Operations Predictions for 2027Last week I argued that the bottleneck in detection engineering moved from writing rules to investigating alerts. If you …
Posts
Detection as Code 101: How It's Done at DatadogIt’s Friday afternoon. Someone tunes a noisy rule directly in the SIEM console, saves it, and logs off. Monday …
Posts
OS Weekly: When Your Trusted Tools Become the Way InThis week’s lesson is uncomfortable: the tools you trust most are part of your attack surface. A backup service …
Posts
The Bottleneck Moved: Detection Engineering Heading Into 2027Twenty-two seconds. That’s the median time, per Mandiant’s M-Trends 2026, for initial access to be handed …