Blog

Detection engineering, threat research, and security notes.

Code Decides Urgency, AI Decides the Fix: Automating Vulnerability Triage with n8n
How I wired a vulnerability scanner, EDR telemetry and a self-hosted LLM into n8n to turn thousands of monthly findings into a handful of approved, ready-to-work tickets.
↗
Map Their Moves -- How TTP Gap Analysis Keeps Your Controls Honest
When a new threat actor or ATP surfaces, the real question isn't who they are -- it's whether your current controls would actually stop them.
↗
Can You Inject Code Into a Car With Radio Waves?
A thread-pull from CAN bus fundamentals to RF injection attacks and automotive bug bounty research.
↗
ClickFix: How a Fake CAPTCHA Runs PowerShell on Your Machine
A breakdown of the ClickFix social engineering technique, how it works under the hood, and what a real detection looks like.
↗
How I Triage Patch Tuesday Without Losing My Mind
A practical workflow for cutting hundreds of CVEs down to what actually matters in your environment.
↗
Trust No Packet -- First Post
Why I started this blog, what to expect, and the principle behind the name.
↗