BadAI Research & Noteshttps://badai.red/research2026-10-30T00:00:00ZBadAI ResearchHow often should you pentest? A model of the exposure windowhttps://badai.red/research/exposure-window-model2026-10-30T00:00:00ZA closed-form model, checked by Monte Carlo, of how testing interval, detection rate, fix time and attacker speed combine into the probability an exposure is exploited before it is closed.Fix the chokepoint, not the 9.8: a Monte Carlo study of attack-path remediationhttps://badai.red/research/attack-path-remediation2026-10-30T00:00:00ZOn 40 synthetic attack graphs we compare severity-first, likelihood-first and path-aware remediation. With a 10-fix budget, path-aware fixing cut breach probability to 15% in diffuse networks while likelihood-first left 76%.Measuring prompt-injection attack success rate without fooling yourselfhttps://badai.red/research/measuring-prompt-injection-success-rate2026-10-30T00:00:00ZConfidence intervals that work at low counts, how many attempts prove a guardrail holds, why best-of-N attackers follow a power law, and how many trials it takes to compare two defenses. With code and real computations.How many SOC analysts do you need? A queueing model of alert triagehttps://badai.red/research/soc-staffing-queueing-model2026-10-30T00:00:00ZErlang C and a discrete-event simulation of a SOC handling 1,200 alerts a day: why queues explode near full utilization, how handling-time variance doubles waits, and what AI pre-triage actually changes.Why most alerts are false: the base-rate problem in alert triagehttps://badai.red/research/base-rate-alert-triage2026-10-30T00:00:00ZBayes' theorem explains SOC alert fatigue. We derive alert precision vs prevalence, the cost-optimal triage threshold for an AI analyst, and how much model separability (d′) it takes to escalate fewer alerts without missing incidents.Research: five reproducible models publishedhttps://badai.red/notes#2026-10-30-research-five-reproducible-models-published2026-10-30T00:00:00ZWe published five research posts with the code behind them: exposure windows, attack-path remediation, ASR statistics, SOC queueing and base rates in triage.Learn hub: compliance, glossary and templateshttps://badai.red/notes#2026-10-30-learn-hub-compliance-glossary-and-templates2026-10-30T00:00:00ZNew reference pages for PCI DSS 11.4, DORA TLPT, NIS2 reporting and SEC Item 1.05, plus a rules-of-engagement template and an incident response checklist.Rogue/AI: MCP server inventoryhttps://badai.red/notes#2026-10-21-rogue-ai-mcp-server-inventory2026-10-21T00:00:00ZRogue/AI now enumerates MCP servers connected to in-scope agents and tests tool descriptions and schemas for tool poisoning before attacking the agent itself.Guides publishedhttps://badai.red/notes#2026-10-12-guides-published2026-10-12T00:00:00ZFive field guides for security leaders, starting with autonomous penetration testing.