Case files
Every file follows the same five beats — briefing, threat model, method, findings, impact — so the work can be compared across domains rather than taken on trust. Exhibits are redacted until you reach them.
Domain
Classified
Decoding Malicious Camouflage
How three malware families slip past AMSI and EDR — dissected in an isolated lab and mapped to 30 MITRE ATT&CK techniques.
Any.RunREMnuxT1562.001
Open file
Classified
Mapping Detections to ATT&CK Coverage
Turning observed adversary behaviour into a technique coverage map — and using the gaps to decide which detections to build next.
MITRE ATT&CKSplunkDefender
Open file
Classified
Risk-Led Triage Across an Enterprise Estate
Prioritising vulnerabilities with CVSS and threat-intelligence-led criteria, then driving remediation to closure with the teams that own the fix.
CVSSNessusRisk acceptance
Open file
No case files in that domain yet.