Why 32 Threat Leads Did Not Become Hunt Packages
A production snapshot of ThreatWatch shows how corroboration, observables, ATT&CK context, and readiness thresholds keep developing leads out of the qualified hunt queue.
~/research/blog
Research blog
One or two substantive articles each month. I write about the decisions, failures, and evidence behind ThreatWatch and RedBlue, with enough source material for a reader to challenge the conclusion.
Published research10 articles
Public Discovery Is Not Permission to Scan
Why RedBlue keeps public asset research separate from direct testing, and what NIST and bug-bounty scope guidance say about authority.
Subdomain Takeover Checks Start With the Asset Graph
An August RedBlue retrospective on registrable domains, retained subdomains, and why better enumeration must remain behind an exact scope boundary.
I Moved the LLM Out of the Scan's Critical Path
A July RedBlue retrospective on one deterministic scan brain, durable triage, and using model output as advice rather than authority.
A Clean Scan Can Mean the Scanner Never Ran
A June engineering retrospective on scanner-dropout visibility, reachability-aware priority, and why zero findings need an execution record.
In Exposure Management, Stealth Should Mean Restraint
A May RedBlue retrospective on making scan mode visible, skipping loud checks, and keeping escalation an explicit operator decision.
More Threat Feeds Did Not Automatically Mean Better Intelligence
An April retrospective on source growth, silent failures, test coverage, and the point where feed count stopped being a useful quality measure.
RedBlue Had to Work When the AI Layer Did Not
A March build retrospective on recursive asset discovery, deterministic reporting, and why optional intelligence should never become a platform dependency.
MFA Did Not End Phishing. It Moved the Target
A session-focused reading of adversary-in-the-middle phishing, why the phrase MFA bypass is imprecise, and where phishing-resistant authentication helps.
A Longer Context Window Is Also a Larger Attack Surface
My January review of many-shot jailbreaking changed how I think about retrieved context, repeated examples, and the security boundary around model-assisted tools.
Field note archive
Page 1 of 3Earlier build notes remain available for context. They are historical records, not current research claims.
ThreatWatch Evidence Quality
Why incomplete source material should lower confidence, and where I draw the evidence boundary between ThreatWatch and RedBlue.
Evidence-Based Vulnerability Triage
I stopped asking severity to do all the work and added exploitation evidence, exposure, and authoritative catalogues.
AI Security and Changing Threat Economics
Automated vulnerability research is moving quickly. I am more interested in adaptable evidence pipelines than precise forecasts.
Threat Triage and Pipeline Reliability
Why I put collection reliability ahead of more feeds, and exposure context ahead of raw vulnerability severity.
Connecting RedBlue and ThreatWatch
Connecting RedBlue to real evidence exposed the places where enrichment ends and analyst judgement must begin.
RedBlue Goes Live
I published the first RedBlue dashboard and made the loop from external visibility to defensive action visible.
RedBlue Integration and CTI Signal Density
The first RedBlue data flow worked, and ThreatWatch made the case for measuring unique signal rather than source count.
ThreatWatch Deduplication and RedBlue Data
I tightened duplicate grouping in ThreatWatch and drew a firmer evidence boundary for what RedBlue can consume.
ThreatWatch Feed Freshness
A reachable feed can still be stale. I made freshness visible so old data no longer looked current.
RedBlue Dashboard Early Work
The first RedBlue dashboard showed me where the modules connected and where the evidence contracts were still weak.