Wes

deep research

[DEEP RESEARCH] The registry did not see the breach. The runner did.

A practical operating model for package admission, runtime detection, and proving downstream impact before the trail goes cold.

weekly

[SIGNALS WEEKLY] Control Planes Under Pressure: KEV, AI, and Identity

Patch the control plane, then hunt leaked authority: new admins, fresh tokens, API use from new origins. Copied keys can outlive a green patch dashboard.

gametheory

[GAME THEORY] The Model Was Not Breached. It Was Mined.

The attacker needs sustained, useful output. Defenders can turn that dependency into friction across the access ecosystem.

gametheory

[GAME THEORY] The operator was not the customer. The quartermaster was.

Shared intrusion logistics can be a better chokepoint than one APT—if defenders can prove real control-plane dependence.

weekly

[SIGNALS WEEKLY] Exploited Edge, Social Engineering, and Subtle Evasion

A Teams message from “IT” can now be the first step in a domain takeover: remote-support session, silent install, then AD and WinRM movement.

forecasts

[FORECAST] Who Gets to Hack Back for the Government?

Our 45% forecast—and the public signals that would show private cyber effects have moved from authority to action.

gametheory

[GAME THEORY] The help desk is becoming the new intrusion broker.

Vishing works because urgency can become SaaS authority. Break the trust transaction without breaking support.

weekly

[SIGNALS WEEKLY] Compressed View of Current Cyber Threat Landscape

Three clocks are running: active PaperCut exploitation, QTFY infrastructure rebuilding after disruption, and AI-agent activity outpacing log governance. Hunt the transitions—not the tidy incident story.

forecasts

[FORECAST] Ransomware Is Moving the Helpdesk Off the Server

We put a 35% chance on two more extortion crews adopting decentralized victim infrastructure by June 2027.

gametheory

[GAME THEORY] Ransomware Did Not Need a Better Exploit. It Needed a Better Business Model.

RaaS wins on repeatable access and recovery pressure. Here is how defenders can break the cheap path before encryption.

weekly

[SIGNALS WEEKLY] Quiet Fault Lines in Identity, Perimeter, and CI/CD

The quiet failure mode in this week’s signals is trust doing exactly what it was configured to do—for the wrong operator. A TeamCity foothold can expose secrets and poison downstream artifacts..

forecasts

[FORECAST] The SaaS connector is where trust becomes blast radius.

A 30% forecast—and a practical way to reduce the cross-tenant blast radius before the next connector compromise.