Writing
Research and field notes
Deep dives, threat analysis, and notes from the work - mostly on AI and agent security, sometimes on whatever is breaking this week.
Latest
A Repeatable Threat-Hunting Exercise for Small Security Teams
Run a failed-sign-in and role-grant query against invented events. Eight cases expose its timing rules, tenant boundaries, and missing-event problem.
September 9, 20265 min readDetection Engineering
Read article
September 9, 20264 min read
Evaluating Identity Detection Coverage Across MSP Tenants
Check what each customer tenant is sending, then follow a detection through the central case and back to an authorized response.
Microsoft EntraIdentityMSP