Technical writing
Notes and analysis on threat intelligence, OSINT tradecraft, AI-assisted analysis and security engineering.
The last mile is where most threat intelligence value dies. Turning an assessment into a detection converts something probabilistic and time-bound into something deterministic and permanent — and almost nothing in the usual design notices the conversion.
Every stage has an owner and a test. Every boundary between stages has neither. That is where intelligence pipelines actually break — and the failure is invisible because each stage, examined alone, is working correctly.
Language models are useful in intelligence work in proportion to how rigorously you measure them. Without a baseline, a confidence contract, and an audit trail, an AI pipeline does not produce intelligence — it produces fluent, unfalsifiable assertions at scale.
Open sources can take you a long way toward naming an adversary — and they can take you confidently to the wrong name. The discipline is not in the collection; it is in what you are willing to claim from it.
Threat intelligence is not a feed of indicators. It is a decision-support product with a consumer, a question, and a stated confidence — and most of what is sold under the name fails all three tests.