IR
Phishing as a Service 2.0: The Franchise Model of Cybercrime
The Golden Arches of Malice When you think of franchising, you probably picture McDonald’s, Starbucks, or Subway — not cybercriminals. But the uncomfortable truth is that modern cybercrime looks a lot less ...
LLMs in Security Operations: Helpful Sidekick or Hallucinating Intern?
Large language models (LLMs) are everywhere now. Your inbox, your SIEM, maybe even embedded in your security tool’s new “AI assistant” tab. It’s tempting to believe these tools are ready to triage ...
Trust Engineering: Building Security People Actually Believe In
Security doesn’t work without trust. You can deploy all the right tools, write high-fidelity detections, and put together a solid incident response plan—but if the engineers roll their eyes every time you ...
The Detection Rebuild, Part 2: Automating Detection Engineering Without Breaking the SOC
Coming off the heels of Part 1, where we focused on fixing the signal problem, Part 2 is all about scale. Because once you’ve cleaned up your alerts and improved your detection ...
The Detection Rebuild, Part 1: Fixing the Signal Problem
How to Stop Drowning in False Positives and Start Surfacing Real Threats Let’s be honest: most security teams aren’t short on alerts—they’re short on good ones. Every SOC eventually hits the same ...
Tycoon 2FA: How Storm-1747 Built an MFA-Bypassing Phishing Empire
We used to believe MFA was the ultimate line of defense. Then phishing kits like Tycoon 2FA showed up and proved otherwise. Unlike the crude clones of years past, Tycoon 2FA leverages ...
Security Debt Is Worse Than Tech Debt — and Twice as Invisible
Security Debt Is Worse Than Tech Debt — and Twice as Invisible We talk about tech debt like it’s a necessary evil. Move fast, break things, fix it later. Everyone’s cool with ...
Why AI is Just Another Tool in Our Blue Team Toolbox
You can’t scroll through LinkedIn, attend a security conference, or open a vendor whitepaper these days without hearing that AI is about to replace the SOC. Some companies claim AI can triage ...
How I Got ChatGPT to Write Ransomware (and Why That Actually Matters)
Introduction: The AI Cybersecurity Paradox If you’ve ever tried to ask ChatGPT to help you build ransomware, chances are you got shut down fast. Like, brick-wall fast. That’s because AI models like ...
The Identity IR Playbook Against Scattered Spider Attacks
Scattered Spider adversary group has been extremely active in the past month, increasing its outreach to financial and insurance entities. This group features an extensive and in-depth use of identity compromise in ...
