Wandering around Gartner Summit last week I was surprised how much I was seeing the term “autonomous’’ making its way into vendor marketing. …

Manual processes are rubbish. People are slow. I don’t mean this as a pejorative, but we’ve spent years building faster machines, embracing containerization, and growing the scale upon which our operating environments exist to the point where the processes we rely on to maintain our security posture can no longer…

MITRE Engenuity just published the results of their fourth Enterprise ATT&CK Evaluation. As I’ve done for the past four years, I’ve published source code for analyzing the results on my personal GitHub page (​​https://github.com/joshzelonis/WizardSpider-Sandworm) …

There are two truths about Zero Trust, it’s a fundamental architectural approach to securing an environment, and no one really understands it. I absolutely share the blame here because in my time at Forrester we tried to map everything to Zero Trust to the point we even had to create…

Do you trust your Endpoint Detection and Response (EDR) Vendor to modify your network infrastructure? …I’ll hold your beer while you think about it. “Your Scientists Were So Preoccupied With Whether They Could…” EDR is an interesting place to begin exploration into what automated response capabilities we should expect from Extended Detection and Response (XDR), especially as there’s so…

The MITRE ATT&CK Evaluation is published as a scientific data set to enable you to interpret information about specific products such as their product strategy and efficacy. A consequence of this is that it also opens the possibility for marketers to run wild with claims of having “won” the evaluation. …

EDR entered the final phase of Rogers’ Diffusion of Innovations Curve last month, five days after CrowdStrike acquired Humio, when George Kurtz described XDR (not EDR) to the US Senate as an essential technology used by “elite defenders.” …

Business strategy regarding cybersecurity risk management is something that can feel rightly infuriating as a cyber professional, especially in the post-mortem from a breach. In this blog, I’m going to attempt to explain why cybersecurity risk is different from common types of risk we’re familiar with, why market valuation is…

The concept of Indicators of Consequent is something familiar to some, but impacts detection engineering efforts in a way that I think requires a level of formality by adding this to our collective understanding of detection. I’ll introduce the subject with a metaphor of planetary discovery. In the 1840’s, astronomers…