Solving alert fatigue with thresholds, not counts
Reducing alert volume is an outcome, not a goal. The goal is that every alert can be tied to a …
Blog
Notes from the team
Short answers to questions we meet in the field: reading stealer logs, catching typosquats, managing IOCs, closing cases. Research, operations and product notes.
Limits of processing leaked data under Turkish data protection law
Examining leaked data does not mean storing it without limit. Purpose, retention and access must be written down up front.
Product note: finding ownership and closure rationale
A finding without an owner never closes; without a closure rationale it reopens three months later. We made both mandatory …
What goes into a geopolitical risk score?
Relations between states reshape the threat landscape directly. What makes a score useful is knowing which signal predicts what.
Hacktivist campaigns: noise or signal?
Most announced attacks never happen, and most that do are smaller than claimed. There is still something worth watching.
Sanctions lists and supply chain intelligence
When a supplier's jurisdiction changes, so does its risk profile. That is a signal the security team should track too.
Certificate transparency: free and good enough
CT logs are the cheapest way to find assets outside your inventory. They are noisy, but the noise is manageable.
Product note: making a threat score explainable
The score is not the valuable part; the reason for it is. Every point needs a rationale you can show.
Five questions before you close a case
Closure is the most rushed step of a case. Five questions stop the same finding coming back three months later.