Eleven papers on the architecture of active defense.
Written to argue about designs rather than products. The questions they end on are meant to be asked of us as readily as of anyone else — including the one about what we do not detect. Every paper is a free PDF; nothing here asks for your address.
Start here — The Platform
The eight-page booklet the series unpacks: one lake, two planes, and every capability an event consumer. Read this first if you want the shape of the thing before the arguments behind it.
The series
In order. Each stands alone, and each is short enough to read in one sitting.
The gap between knowing and acting
Why a platform that only tells you things is structurally incapable of stopping them — and what closing the loop actually requires.
6 pp · PDF PAPER 02Everything is an event
An alert is a subgraph, not a row. What follows for storage, for correlation, and for what an analyst can ask afterwards.
6 pp · PDF PAPER 03The legitimacy problem
The question is not "is this malicious". Most of what matters is legitimate capability used by the wrong party, and that is a different problem.
6 pp · PDF PAPER 04Compiling what you learn
What a platform learns should become what it enforces. Detection that never reaches an enforcement point is a report with extra steps.
6 pp · PDF PAPER 05Bounded autonomy
Delegation is a design problem, not a setting. Blast radius, canary, rollback and refusal as first-class parts of an automated action.
6 pp · PDF PAPER 06Evidence that survives
Evidence should be a query, not a project. What it takes for an answer given two years from now to be the same answer.
6 pp · PDF PAPER 07The door is not the control
Authentication is a moment; trust is a duration. What a session is still asserting an hour after the login succeeded.
5 pp · PDF PAPER 08What we do not detect
A vendor who publishes no gaps has not found none. The case for a published, measured coverage gap — and what ours looks like.
5 pp · PDF PAPER 09Anything that emits a signal
The integration is where the data model gets decided. Why the decoder, not the dashboard, determines what you can ever ask.
5 pp · PDF PAPER 10One meter
How you are charged decides what you can see. A meter that punishes telemetry produces an estate with blind spots by design.
5 pp · PDF PAPER 11The vendor is part of your attack surface
We are the most privileged software you will install. What that obliges us to publish, and what you should be able to verify without asking.
5 pp · PDF