Detection overhaul with two new ATT&CK objects, Detection Strategies and Analytics, that shift guidance from single-sentence notes to structured, behavior-focused strategies. Workbench now supports Detection Strategies to take full advantage of the defensive updates. medium.com/mitre-attack...

Deeply proud of our Cloud VRP team (Darby & Cote) for a huge body of work re this bugSWAT, and thank you to an AMAZING group of researchers…truly the best of the best. $1.6m awarded for this event alone, and $2.5m total in 2025! Thank you, all. bughunters.google.com/blog/5364401...

I share the use of OctoSQL as a fast CLI interface to vulnerability data aggregated via CVE-Vulnerability-Information-Downloader. If you’ve wanted to join vulnerability data (CVE, CVSS, EPSS) from disparate data sources and file types, this is the toolsmith for you.
holisticinfosec.io/post/octosql/

A robust evaluation framework developed to automatically red-team an AI system’s vulnerability to indirect prompt injection attacks…a walk-through of the threat model, and a description of three attack techniques implemented in the evaluation framework. security.googleblog.com/2025/01/how-...

SecTemplates for infosec professionals, and startup engineering teams lacking a security team, to help bootstrap their programs. Starting points for:
*Preparation checklists
*Runbooks
*Programs and their associated processes
*Useful security metrics
*Document templates github.com/securitytemp...

I’ve neglected holisticinfosec.io and #toolsmith for more than a year. Excuses? Sure…signed to a label & made a record, moved after 27 years in same home, multiple deployments for cyber defense of 2024 election, expanded role at work…but here is my return to form holisticinfosec.io/post/protect...

FediSecFeeds searches CVE data in infosec.exchange and ioc.exchange instances with output fetched via GitHub's API. fedisecfeeds.github.io?utm_source=t...

Proud of my team and cross-functional GCP partners in delivering this. Excited to announce that Google Cloud customers can now track Cloud Abuse Events using Cloud Logging. These events can include leaked service account keys, crypto mining incidents, and malware. cloud.google.com/blog/product...

Great read: serverless env variables contain key-value pairs used to configure & pass information to serverless functions & applications. Sensitive data stored in environment variables (API keys, db credentials, etc) can be compromised if accidentally shared or made public
permiso.io/blog/how-adv...

STAMP shifts perspective on accidents from linear chains of failures to a control problem. The model should explain accidents that result from component failures, but also external disturbances, interactions between components, and incorrect or inadequate behavior. ask www.usenix.org/publications...