Incident Response
Dwell Time as a Security Metric: What It Tells You and What It Hides
Most response programs treat mean time to detect as a success metric. It is not — it is a lagging indicator dressed up as a KPI.
Writing and courses at the intersection of technology, security, and the craft of building systems that last.
Drawn from practice. Written to be useful.
From power button to shell prompt. A 25-article series explaining how a computer actually starts -- voltage, firmware, bootloaders, kernel, filesystem, and shell. Every step, no prerequisites assumed.
From alert to after-action report. Covers triage methodology, evidence preservation, containment decision trees, and structured communication under pressure. Grounded in 20 years of hands-on response work across enterprise environments.
SPAKE2, HKDF, ChaCha20-Poly1305, Ed25519, BLAKE3 — not as theory, but as working components. Build authenticated channels, content-addressed stores, and signed data structures from scratch in Rust.
Apply language models, TensorFlow, and zero-shot classifiers to security telemetry. Build pipelines that surface behavioral anomalies without signature dependency. Real datasets, real tooling, real adversarial conditions.
Not frameworks — outcomes. Covers metrics that matter, stakeholder communication, hiring and retaining analysts, and the organizational patterns that separate durable programs from ones that collapse under pressure.