Research
Models, simulations and statistics behind how we attack and defend. Every number comes from code in our research repository; every post states its assumptions and where it breaks. Atom feed.
How often should you pentest? A model of the exposure window
A closed-form model, checked by Monte Carlo, of how testing interval, detection rate, fix time and attacker speed combine into the probability an exposure is exploited before it is closed.
7 min · read →Fix the chokepoint, not the 9.8: a Monte Carlo study of attack-path remediation
On 40 synthetic attack graphs we compare severity-first, likelihood-first and path-aware remediation. With a 10-fix budget, path-aware fixing cut breach probability to 15% in diffuse networks while likelihood-first left 76%.
6 min · read →Measuring prompt-injection attack success rate without fooling yourself
Confidence intervals that work at low counts, how many attempts prove a guardrail holds, why best-of-N attackers follow a power law, and how many trials it takes to compare two defenses. With code and real computations.
6 min · read →How many SOC analysts do you need? A queueing model of alert triage
Erlang C and a discrete-event simulation of a SOC handling 1,200 alerts a day: why queues explode near full utilization, how handling-time variance doubles waits, and what AI pre-triage actually changes.
6 min · read →Why most alerts are false: the base-rate problem in alert triage
Bayes' theorem explains SOC alert fatigue. We derive alert precision vs prevalence, the cost-optimal triage threshold for an AI analyst, and how much model separability (d′) it takes to escalate fewer alerts without missing incidents.
5 min · read →Find out what bad AI finds.
A 30-minute briefing with an operator. We'll scope a first engagement against one real system of yours and show you the findings format before you sign anything.