From noisy signals to meaningful detection.
An evidence-led approach to investigating model behavior, refining detection logic, and evaluating changes.
Read case studyFollowing the behavior. Not just the indicator.
A structured investigation workflow that brings network behavior, device context, and threat intelligence together.
Read case studyMaking emerging threats actionable.
Turning technical research into evidence-backed assessments and practical recommendations for security stakeholders.
Read case studyReal context. Clear boundaries.
These pages share general analytical methodologies, not proprietary detection logic or confidential investigations. Professional-context figures are documented in my 2026 resume. The hunting workflow is illustrative, not an incident I claim to have handled.