-
What a $40k red team should actually deliver
EDR-heavy environments expose weak red team scoping fast. Here is how to design an engagement that produces decision-quality evidence, not a CVE list.
-
Megalodon and the CI/CD trust problem
5,561 repos got malicious GitHub Actions workflows in six hours. No zero-day, just a merge. Detection and change-control guidance for defenders.
-
Your IDE is in the supply chain now: the GitHub 3,800 Repo Exfiltration Dissected
GitHub confirmed ~3,800 internal repos exfiltrated via a poisoned VS Code extension. We separate vendor-confirmed facts from campaign reporting and inference.
-
What a roomful of threat hunters taught us about detection engineering
Intel 471 skipped the vendor pitch and ran a live threat-hunting CTF. Every team found something different. The complete picture required the room.
-
The MCP server attack surface
MCP servers are running on engineering laptops at most companies, holding production credentials, with no inventory. Here’s the threat model and what to do.