
42 pages · PDF brief
The state of adversary infrastructure, 2026
How bulletproof hosting, residential proxies, and certificate reuse actually look this year — and what that means for blocking versus hunting.
Whitepapers
Working papers for CTI leads, detection engineering, and the occasional board appendix.

42 pages · PDF brief
How bulletproof hosting, residential proxies, and certificate reuse actually look this year — and what that means for blocking versus hunting.

31 pages · PDF brief
A working model for turning finished intel into detections and tickets with owners, evidence, and retirement — the conversion method in full.

18 pages · PDF brief
Stop counting indicators. A short paper on exposure, coverage, and time-to-brief — the three numbers a board can actually use.
Questions
Next step
A forty-minute briefing: your sources, your stack, and the tickets that should already exist.