Agentic AI Security Cheat Sheet: Threat Models, MCP Hardening Checklist and Detection Hooks
One-page agentic AI security cheat sheet: agent threat models, an MCP server hardening checklist, and the log sources and detection hooks blue teams need…
Blog
Alert Fatigue Is a Design Problem: Building a Detection Engineering Lifecycle That Survives Contact
Alert fatigue is a design flaw, not an analyst problem. Learn a full detection engineering lifecycle — hypothesis, build, tune, retire — with MTTD,…
Write Sigma Rules That Actually Fire: A Detection-as-Code Lab with SigmaCLI and splunk-react
Build a hands-on Detection-as-Code lab: author Sigma rules, validate them with sigma-cli, convert them to Splunk queries, and fire real detections in a CI…
Why Planes Don’t Get Hacked — And Where the Next Aviation Cyber Risk Really Is
A deep dive into aircraft cybersecurity: why planes resist hacking, the real attack surface in avionics, satcom, ADS-B, and ground systems, and where the…
What Is Prompt Injection and How to Prevent It: A Complete Exam Prep Guide
Learn what prompt injection attacks are, how they exploit LLMs, and the most effective defenses, ranked - a study guide for cybersecurity exam aspirants.
Pyramid of Pain to Production: How Detection Engineers Prioritize What to Hunt
A hands-on guide mapping the Pyramid of Pain and MITRE ATT&CK to real detection engineering decisions: what to hunt first, which telemetry to collect, and…
Build a Free Elastic Security SOC: Ingest Sysmon, Create Dashboards and Triage Alerts
Learn how to build a free SOC lab with Elastic Security: install Sysmon, ingest Windows event logs via Winlogbeat, build detection rules, dashboards, and…
Testing JWT Security with jwt-cli and Caido: Alg Confusion, Weak Secrets, and Expired Claims
Hands-on tutorial covering the four most common JWT flaws—alg confusion, weak HMAC secrets, expired claims, and missing validation—using jwt-cli and Caido, with verifiable commands and hardened configs.
Weekly Threat Intel: 30 September 2026 — npm Malware, Typosquat Waves and Autumn CVEs
This week's threat intel digest: npm malware campaigns, typosquat waves, loader shifts and newly exploited CVEs — verified facts, IOCs and hands-on detection steps for practitioners.
Evilginx3 Lab: Build a Safe AiTM Phishing Lab to Understand Session Cookie Theft (and Why FIDO2 Stops It)
Build a self-hosted Evilginx3 lab to safely study adversary-in-the-middle phishing, session cookie theft, and why FIDO2/WebAuthn defeats AiTM attacks.
MFA Fatigue and Push Bombing: How Attackers Wear Down Your Users
Deep dive into MFA fatigue and push bombing attacks: mechanics, the 2022 Uber breach, and practical defenses like number matching, rate limiting, and Conditional Access.
Shodan and Censys for Attack Surface Recon: A Hands-On OSINT Lab with Ethics Guardrails
Learn attack surface reconnaissance with Shodan, Censys, and crt.sh in this hands-on OSINT tutorial for blue-teamers and CTF players, with clear ethical…