Research

Most ATT&CK programs model tactics and techniques, but not procedures. This post explains why that gap matters, where Attack Flow helps, and how STIX could model the missing layer.

Known ATT&CK techniques are not just for labeling incidents. This post shows how to use them as anchors to infer likely predecessor and successor behavior in a realistic adversary sequence, and how MITRE TIE can support that workflow.

D3FEND becomes far more useful when it is not isolated. This post shows how D3FEND links to ATT&CK and CWE through artefacts, so you can traverse from offensive technique or weakness to concrete defensive mitigations.

A practical approach to representing Indicators of Prompt Compromise (IoPC) in STIX, introducing prompts as first-class observables, separating intent through Indicators, and linking activity to MITRE ATLAS techniques for intelligence sharing and detection.

Tactics and techniques are not enough on their own. Learn why procedures are the missing operational layer in ATT&CK, and how to model procedure-level attack paths in STIX with Attack Flow.

This post shows a simple way to link Sigma detections to Attack Flow steps so analysts can see what fired, where they are in an attack path, and what coverage is missing.

Despite countless frameworks, best practices, blog posts... so many developers still hardcode credentials into their code.

I wanted to write detection rules to identify what products are vulnerable to a CVE. In this post I walk you through my research.

Discover how MITRE ATLAS is helping to defend AI systems as I share a detailed explanation of how the knowledge-base is architected.