Practical security writing. No fluff, no vendor content.
Vulnerability research has changed. An AI sweep produces leads by the pile, and the line between automated slop and a useful report is blurry. What separates them is the verification and judgment applied afterward, which is how one lead became CVE-2026-7787 in Langflow.
A behavioral framework for AI-era impersonation across email, voice, video, chat, and in-person asks. Empirically grounded in 2,511 classifications from the Threat Terminal study. Trigger on the action request, not on the content.
Anthropic's Mythos Preview report measures the model I can actually run. So this weekend, I ran it on my house. Here is what Opus 4.6 did.
I pulled 1,011 live cybersecurity postings and enriched them with an LLM. CISSP dominates, entry-level is a mirage, remote work is mostly gone, and half of employers still won't post a salary.
I spoke at Palm Beach State College's Cybersecurity Symposium on how security teams use AI in practice and what students can do right now to prepare.
Findings from 153 participants classifying AI-generated phishing: technique-level bypass rates, overconfidence patterns, and what security training misses.
Most gamified security training is a quiz with a badge. Real game design looks fundamentally different, and it matters for engagement and measurement.
Real-time 1v1 ranked matches, a new unlock ladder, and a terminal AI that will not stop talking. Threat Terminal v2.0 goes live tonight.
What is changing in Threat Terminal v2: complete UI overhaul, persistent progression, daily challenges, ranked PvP, badges, and a coin economy.
Preliminary descriptive patterns from 100 participants and 1,612 classified emails in Threat Terminal, before formal statistical analysis begins.
Pilot data from 56 participants in Threat Terminal reveals which phishing techniques humans miss most when AI eliminates writing quality as a signal.
Phishing emails with no urgency, no threats, and no red flags bypass humans at three times the rate of credential harvesting. Training has it backwards.
Most people catch phishing because they know they do not have an Apple account, not because they spotted a spoofed domain. That distinction matters.
AI eliminated the grammar errors and broken formatting phishing training taught people to spot. The detection problem is now fundamentally different.
How I built a controlled phishing dataset with the Claude API: batching by technique, automated review, and handling rate limits at scale.
Decisions, pivots, and problems behind designing a phishing research study, and why the constraints produced a cleaner methodology than planned.
Threat intelligence does not have a quality problem. It has an attention problem. Here is what I built to fix that.
When AI eliminates grammar errors as a detection signal, the question becomes: which phishing techniques produce the biggest gaps in human detection?
Enterprise Entra tenants accumulate years of vendor integrations, abandoned POCs, and forgotten service principals. Most have never been audited.
Most people break into cybersecurity the wrong way. Here is what I actually tell people who ask me how to get started.
Security analysts who never touch offensive work are missing something. You cannot fully defend what you have never tried to break.