Selected narratives from building ThreatWatch and RedBlue, covering context, decisions, evidence, and lessons.https://nicholai.me/en-gbhttps://nicholai.me/research/week-19-2026/https://nicholai.me/research/week-19-2026/The latest journal entry focuses on improving evidence quality, collection resilience, and the connection between ThreatWatch findings and RedBlue workflows.Sun, 26 Apr 2026 00:00:00 GMThttps://nicholai.me/research/week-18-2026/https://nicholai.me/research/week-18-2026/ThreatWatch continued improving vulnerability prioritisation by combining severity with exploitation evidence and authoritative catalogues.Sun, 19 Apr 2026 00:00:00 GMThttps://nicholai.me/research/week-17-2026/https://nicholai.me/research/week-17-2026/Research into automated vulnerability discovery raised new questions about how quickly defensive priorities may need to adapt.Sun, 12 Apr 2026 00:00:00 GMThttps://nicholai.me/research/week-16-2026/https://nicholai.me/research/week-16-2026/Vulnerability prioritisation, ThreatWatch collection reliability, and keeping RedBlue analysis tied to current evidence.Sun, 05 Apr 2026 00:00:00 GMThttps://nicholai.me/research/week-15-2026/https://nicholai.me/research/week-15-2026/RedBlue modules began exchanging real evidence, including threat context from ThreatWatch and controlled event data for detection analysis.Fri, 27 Mar 2026 00:00:00 GMThttps://nicholai.me/research/week-14-2026/https://nicholai.me/research/week-14-2026/RedBlue reached its first public dashboard milestone, bringing external visibility, threat profiling, detection analysis, and response into one platform direction.Sun, 22 Mar 2026 00:00:00 GMThttps://nicholai.me/research/week-13-2026/https://nicholai.me/research/week-13-2026/The first RedBlue module integrations worked, while ThreatWatch source growth showed why unique signal matters more than feed volume.Sun, 15 Mar 2026 00:00:00 GMThttps://nicholai.me/research/week-12-2026/https://nicholai.me/research/week-12-2026/ThreatWatch improved near-duplicate grouping, and RedBlue began evaluating detection coverage against campaign context derived from threat intelligence.Sat, 14 Mar 2026 00:00:00 GMThttps://nicholai.me/research/week-11-2026/https://nicholai.me/research/week-11-2026/Feed freshness became a visible ThreatWatch quality signal, helping distinguish current intelligence from stale or unavailable reporting.Sun, 08 Mar 2026 00:00:00 GMThttps://nicholai.me/research/week-10-2026/https://nicholai.me/research/week-10-2026/The first RedBlue dashboard prototype made the platform architecture tangible and clarified how threat profiles and detection coverage should connect.Sat, 07 Mar 2026 00:00:00 GMThttps://nicholai.me/research/week-09-2026/https://nicholai.me/research/week-09-2026/The detection coverage work expanded into RedBlue, a platform connecting attack-surface visibility, threat profiling, detection validation, and response.Sun, 01 Mar 2026 00:00:00 GMThttps://nicholai.me/research/week-08-2026/https://nicholai.me/research/week-08-2026/A focused review of threat actor tradecraft and a structured approach to auditing ThreatWatch source health and signal quality.Sun, 22 Feb 2026 00:00:00 GMThttps://nicholai.me/research/week-07-2026/https://nicholai.me/research/week-07-2026/Indirect prompt injection remains a core risk for systems that retrieve untrusted content and pass it to a language model.Sun, 15 Feb 2026 00:00:00 GMThttps://nicholai.me/research/week-06-2026/https://nicholai.me/research/week-06-2026/ThreatWatch shifted from simple keyword ranking towards novelty, freshness, and source health as first-class signals.Sun, 08 Feb 2026 00:00:00 GMThttps://nicholai.me/research/week-05-2026/https://nicholai.me/research/week-05-2026/A controlled review of adversary-in-the-middle phishing reinforced why origin-bound authentication is stronger than reusable codes.Sun, 01 Feb 2026 00:00:00 GMThttps://nicholai.me/research/week-04-2026/https://nicholai.me/research/week-04-2026/Research into QR phishing highlighted how attacks can move activity from managed email systems to personal mobile devices.Sun, 25 Jan 2026 00:00:00 GMThttps://nicholai.me/research/week-03-2026/https://nicholai.me/research/week-03-2026/D3FEND mappings were added to the detection model, allowing the first campaign-level view of rules, telemetry, controls, and remaining gaps.Sun, 18 Jan 2026 00:00:00 GMThttps://nicholai.me/research/week-02-2026/https://nicholai.me/research/week-02-2026/A review of many-shot jailbreaking and what long-context attacks mean for systems that use language models in security workflows.Sun, 11 Jan 2026 00:00:00 GMThttps://nicholai.me/research/week-01-2026/https://nicholai.me/research/week-01-2026/The campaign and detection data model moved into implementation, with ThreatWatch analysis quality set as the parallel priority.Sun, 04 Jan 2026 00:00:00 GMThttps://nicholai.me/research/week-08-2025/https://nicholai.me/research/week-08-2025/A concise review of the first seven weeks: ThreatWatch was operational, the detection coverage model had a schema, and the next priority was connecting intelligence to action.Sun, 28 Dec 2025 00:00:00 GMThttps://nicholai.me/research/week-07-2025/https://nicholai.me/research/week-07-2025/A focused review of graph-based detection models and why campaign-level coverage is more useful than isolated technique counts.Thu, 25 Dec 2025 00:00:00 GMThttps://nicholai.me/research/week-06-2025/https://nicholai.me/research/week-06-2025/The detection coverage idea became a concrete data model linking campaigns, ATT&CK techniques, rules, telemetry requirements, and defensive controls.Thu, 18 Dec 2025 00:00:00 GMThttps://nicholai.me/research/week-05-2025/https://nicholai.me/research/week-05-2025/ThreatWatch expanded its source coverage while research into model security reinforced the need to keep automated analysis evidence-bound.Thu, 11 Dec 2025 00:00:00 GMThttps://nicholai.me/research/week-04-2025/https://nicholai.me/research/week-04-2025/A controlled phishing simulation workflow reached an end-to-end lab milestone and exposed useful detection and reporting requirements.Thu, 04 Dec 2025 00:00:00 GMThttps://nicholai.me/research/week-03-2025/https://nicholai.me/research/week-03-2025/ThreatWatch moved from headline matching to content fingerprints, while D3FEND provided a clearer vocabulary for connecting adversary behaviour to defensive measures.Thu, 27 Nov 2025 00:00:00 GMThttps://nicholai.me/research/week-02-2025/https://nicholai.me/research/week-02-2025/The first ThreatWatch aggregation cycle made the central challenge clear: collecting feeds is easy, but separating useful intelligence from repeated reporting is not.Thu, 20 Nov 2025 00:00:00 GMThttps://nicholai.me/research/week-01-2025/https://nicholai.me/research/week-01-2025/The first architecture notes for ThreatWatch and an early question that still guides the work: how much detection coverage is practical with the telemetry organisations actually have?Thu, 13 Nov 2025 00:00:00 GMT