Fancy Bear Hackers: A Research-Based Overview of APT28

A defensive, research-based overview of Fancy Bear (APT28): who the group is, how it is tracked, who it targets, the major incidents publicly attributed to it, and the practical lessons for defenders.

Getting Started with Vulnerability Management

Foundational guide for teams beginning a vulnerability management program. Covers asset discovery, scanner selection, risk-based prioritization and remediation workflows.

Building a Threat Intelligence Workflow

Step-by-step guide for establishing a threat intelligence collection and analysis workflow. Covers source selection, normalization, enrichment and dissemination.

Ransomware Response: First 48 Hours

Practical guide for the critical first 48 hours of a ransomware incident. Covers initial containment, evidence preservation, communication protocols and recovery planning.

AI Security for Defenders

Introduction to AI security concepts for defensive security teams. Covers prompt injection, model poisoning, adversarial inputs and AI supply chain risks.

Cloud Security Fundamentals

Essential cloud security guide covering shared responsibility, identity and access management, network isolation, encryption and compliance monitoring across major cloud providers.

SOC Analyst Runbook: Alert Triage

Practical runbook for SOC analysts handling alert triage. Covers severity classification, enrichment steps, escalation criteria and false positive identification.

Privacy Engineering for Security Teams

Advanced guide connecting security practices to privacy requirements. Covers privacy by design, data minimization, retention policies and cross-functional collaboration.

Threat Hunting with MITRE ATT&CK

A hypothesis-driven threat hunting guide that uses the MITRE ATT&CK framework to proactively search telemetry for adversary behavior, then convert successful hunts into durable detections.

Securing LLM Applications: Prompt Injection and Defenses

A practical, defense-focused guide to hardening LLM-powered applications and agents against prompt injection, insecure output handling, and related OWASP LLM Top 10 risks.

Defending Against AI-Powered Phishing and Deepfakes

Defend your organization against generative-AI-enhanced phishing, voice clones, and deepfake video by shifting to context-based detection, hardened email controls, out-of-band verification, and phishing-resistant authentication.

AI-Assisted Detection and SOC Automation

A practical guide to using AI, machine learning, and automation to augment human SOC analysts in detection and response without surrendering judgment to the machine.