Speed vs Depth: The SOC Maturity Metric Your Board Actually Wants
Speed vs Depth: The SOC Maturity Metric Your Board Actually Wants Why MTTR measures activity, not maturity — and what […]
Engineering Theses
Senior-practitioner framework essays and detection-engineering depth.
From Alerts to Decisions
Detection without context is guesswork dressed up as certainty. How a mature SOC turns raw alerts into evidence-weighted decisions — and noise into business consequence.
The Cyber Kill Chain Is Not Dead. MITRE ATT&CK Is Its Higher-Resolution Successor.
The Lockheed Cyber Kill Chain is the executive view. MITRE ATT&CK is the operational view — same story, different resolution.
Sap the Silicon
The quiet diagnostic that separates senior detection engineers from earnest ones — and why a 350-row spreadsheet is not a use case program.