Posts

What the new mapping actually buys you, where teams misread it as control equivalence, and how much rework that mistake creates.

The Council named future technology and AI innovation in its request for comments. Here’s how the RFC process works and what happens next.

Blockchain C2 removes the domain you’d normally report. Why that pushes defense to exactly where PCI DSS 6.4.3 and 11.6.1 already point.

How the traffic laundering economy turns jailbroken FireSticks into residential proxies, and what defenders can actually do about it.

Anthropic disabled two frontier models worldwide to comply with an export directive. The practitioner takeaways on dual-use AI and availability risk.

Two disclosures, one pattern. The AI tools adopted for productivity are now both an exfiltration surface and an instruction-injection surface.

A practitioner primer on protocol abuse: how data quietly leaves networks through DNS, ICMP, HTTPS/TLS, and the headers of TCP itself.

The first publicly available Mythos-class model. A look at capability gating, the two-tier release model, and what it signals for defenders.

A practitioner breakdown of the npm worm that sweeps environment variables on install and republishes itself through Trusted Publishing.

The largest DBIR ever published, read for signal. Where generative AI actually shows up in the data and where the fundamentals still rule.