วิบูลอิสร แก้วลภัสทรัพย์
Cyber Intelligence · AI Systems · Technology
Exploring the intersection of cyber threat intelligence, artificial intelligence, security engineering and technology.
Adversary tracking, indicator lifecycle, and the evidence chain from raw collection to an assertion someone can act on.
Collection from public sources with provenance preserved — where a finding came from matters as much as the finding.
Using language models as analytical instruments, measured against deterministic baselines rather than assumed to be better.
Building systems where the safe path is the easy path, and where failure states are distinguishable from silence.
Automating the repeatable parts of defence without automating away the judgement.
Multi-agent systems with observability, causal tracing, and verifiable control planes.
Translating technical capability into decisions that hold up outside the lab.
Operational discipline, procedure, and consequence.
Threat intelligence, collection, and analysis.
Applied AI and multi-agent system design.
Building technology ventures.
Cyber Threat Intelligence
An eight-stage pipeline from public sources to SOC detection — and the specific way each stage fails. Most pipelines do not break where they are monitored; they break at the handoffs, silently, in the direction of false confidence.
Collection & Measurement
Every collection programme has a shape, and the shape determines what it can never see. Most programmes measure volume and coverage against their own output — a denominator that cannot detect the data that never arrived.
Cyber Threat Intelligence
An indicator is an observation. Intelligence is an observation someone can act on, with a stated confidence and an expiry. The distance between them is where most security programmes quietly lose the value they paid for.
The last mile is where most threat intelligence value dies. Turning an assessment into a detection converts something probabilistic and time-bound into something deterministic and permanent — and almost nothing in the usual design notices the conversion.
Every stage has an owner and a test. Every boundary between stages has neither. That is where intelligence pipelines actually break — and the failure is invisible because each stage, examined alone, is working correctly.
Language models are useful in intelligence work in proportion to how rigorously you measure them. Without a baseline, a confidence contract, and an audit trail, an AI pipeline does not produce intelligence — it produces fluent, unfalsifiable assertions at scale.
Open-source reference implementation of confidence, corroboration and assessment primitives for cyber threat intelligence — two-axis Admiralty grading, ICD 203 estimative bands, three assessment states, and corroboration counted by independent origin.
For professional enquiries, research collaboration, or speaking requests.
Get in touch