Detection engineering
Detection as code: start with the hypothesis ↗
Turn an attacker behavior into a testable detection, without drowning your team in alerts.
Field notes.
Practical ideas for a stronger defense. Find your next deep dive.
3 articles
Cloud security
Your cloud perimeter is an identity ↗
A focused workflow for reviewing workload permissions, trust relationships, and forgotten credentials.
Incident response
The first 30 minutes of an incident ↗
Preserve evidence, establish ownership, and make the next decision easier with a repeatable triage plan.
No matching field notes. Try a different keyword.