A Repeatable Threat-Hunting Exercise for Small Security Teams
A local identity hunt with synthetic records, executable SQL, negative cases, and explicit blind spots.
Read article
KevinBytes
Research and field notes on AI security, threat detection, and the systems I build and test.
By Kevin O'Connor
Latest writing
All writingChoosing an AI Agent Memory Service: Security and Performance Tradeoffs
A memory-service decision method with a small local SQLite experiment, tenant checks, deletion limits, and latency measurements.
Read articleEvaluating Identity Detection Coverage Across MSP Tenants
A bounded Microsoft Entra evaluation method, with synthetic cases for correlation and tenant separation.
Read articleStart here
A few ways into the research, depending on what you’re working on.
AI and agent security
Follow the data, permissions, and evidence behind an agent system.
Explore this reading pathDetection and threat research
Turn a detection claim into a repeatable exercise and an analyst question.
Explore this reading pathSecurity architecture
Make system boundaries, assumptions, and design decisions easier to review.
Explore this reading pathTools & experiments
All toolsSecurity tools
Decode tokens, inspect indicators, calculate subnets, and check security headers.
Steganography Lab
Hide messages in images, inspect the pixels, and learn how steganography works.
AI Tree of Life
An interactive app for exploring AI systems, model families, and the relationships between them.
GHS label builder
Create chemical labels with GHS pictograms and hazard statements.
NFPA diamond builder
Create and print NFPA 704 fire diamonds.
AgentBoundary
Evaluates autonomous AI agents against adversarial patterns such as prompt injection, memory poisoning, tool misuse, and context drift.
Stay curious.
New research, technical notes, and experiments.
Delivered when there's something worth sharing.
Conversations & perspectives
SecurityWeek
Hacker Conversations: Kevin O'Connor
A conversation about offensive and defensive cybersecurity work.
Security Magazine
Holiday weekend cyber threat preparation
How security teams can prepare for cyber threats over holiday weekends.
CISO Tradecraft
SMB CISO challenges
Security challenges for small and midsize businesses, including managed detection and response.
BrightTALK
Enabling Threat Detection and Response
On-demand talks on threat detection, security monitoring, and threat hunting.
Behind the bytes
I'm Kevin O'Connor, a security researcher and engineer working on adversarial AI systems, detection engineering, and practical security tools.
Alexandria, Virginia / Washington, DC Metro — available nationwide
Get in touchFormer NSA Technical Director
Served in technical leadership roles supporting computer network operations and defensive security work.
CrowdStrike Advanced Research
Worked on threat intelligence and advanced security research.
Adlumin / N-able threat research leadership
Led research into ransomware, intrusions, and detection methods.
Founder of TKOResearch
AI security research, assessments, and defensive tools.