Writing
Articles and thoughts on cybersecurity, technology and whatever else I am exploring.
-
How I used AI to build and run my portfolio website
Nine pull requests from an AI assistant: faster fonts, blog search, ads with consent, and the moments a human still had to step in.
-
Cutting L1 triage from 15 minutes to 30 seconds
How the enrichment pipeline behind 30-second triage is built, step by step, and an honest list of what it still gets wrong.
-
Tuning detections to remove 35% of false positives
A practical playbook for cutting false positives from custom SIEM detections by about 35% without losing coverage.
-
Can LLMs be trusted in the SOC?
Prompt injection in alert data, hallucinated IOCs and over-privileged agents, and the guardrails that make LLMs safe to use.
-
A threat hunt walkthrough, from hypothesis to detection
One hunt from start to finish: the hypothesis, the CloudTrail queries, what turned up, and the detection that came out of it.
-
Detection-as-code: treating detection rules like software
Version control, tests, peer review and CI for detection rules, and why they make a SOC faster and safer.
-
Incident response lessons from the field
The incident response mistakes that cost time or evidence, anonymised, and what I would do differently next time.
-
From offensive security to blue team
What three years of hunting bugs taught me about catching attackers, and what I had to unlearn on the blue side.
-
A SOC analyst's starter kit
The tools, skills and habits I recommend to every new SOC analyst, from years of training intern cohorts.
-
MFA is not your last line of defense
Info-stealers lift session cookies and tokens, so attackers skip the login entirely. What to detect and change instead.
-
AI will not replace L1 SOC analysts
How LLMs and the Model Context Protocol cut first-pass triage from 15 minutes to 30 seconds, and why that helps analysts.
No articles match.