Wes

deep

[DEEP RESEARCH] The account stealing your data may not be human

The user may start the incident. OAuth apps, tokens, and integrations can turn it into quiet, scalable data theft.

weekly

[SIGNALS WEEKLY] Silent Surfaces: From Zero‑Click Mail to Exposed Controllers

Zero-click Zimbra access, exposed PLC tampering, and Teams-to-ransomware chains compress the defender’s window. Prioritize server logs, controller-change evidence, and external admin-surface discovery.

forecasts

[FORECAST] The Patch Deadline Is Becoming an Attacker's Watchlist

We put a 30% chance on two public FCEB cases proving post-deadline edge exploitation by year-end.

forecasts

[FORECAST] The breach may start after the patch

We put a 45% chance on a public case proving that stolen edge-appliance access survived remediation and enabled a later intrusion.

weekly

[SIGNALS WEEKLY] Perimeter to Persistence: Evolving Paths to Ransomware and OT Access

The perimeter kept the keys. Edge appliances and OT switches are becoming the shortest path from exposure to stolen identity and ransomware. The plumbing became the persistence layer.

gametheory

[GAME THEORY] KEV Is Not a Patch List. It Is a Race for Control.

Nine actively exploited flaws show why patching closes an entry point—but not necessarily the incident.

gametheory

[GAME THEORY] AI gateways are becoming the new IAM chokepoint

AI gateways are starting to concentrate credentials, logs, routing, quotas, and policy. That makes them worth watching now.

weekly

[SIGNALS WEEKLY] Converging Threats Across SaaS, Web Edge, and OT

OAuth consent made SaaS data theft look normal. Niche web plugins kept handing attackers first doors. OT debug ports reminded everyone that “engineering access” can age into exposure.

forecasts

[FORECAST] China-linked ORB networks are becoming espionage logistics

China-linked operators are turning compromised routers into relay logistics. The defender move is behavior over bad IPs.

forecasts

[FORECAST] TeamPCP shows why package cleanup is not containment

Supply-chain attacks are becoming access pipelines. The defender move is to follow credentials, not just packages.

weekly

[SIGNALS WEEKLY] Telephony, Observability, and Identity Under Quiet Pressure

The boring stack moved. CUCM WebDialer. Splunk sidecar. Messaging recovery keys. Very normal. Very annoying.

forecasts

[FORECAST] NetNut/Popa was a capacity disruption, not just a botnet takedown

The NetNut/Popa action matters. The harder question is whether the residential-proxy market reroutes.