Wes

gametheory

[GAME THEORY] AI-agent spoofing is becoming a claim-vs-proof problem

Known AI agents are becoming trusted traffic. The first defender move is finding claims without proof.

forecasts

[FORECAST] The Threat Was Real. The Public Proof Probably Falls Short (Final: 2026-05-21)

The forecast likely resolves No, but the useful lesson is where Iran-linked operators still depend on access defenders can pressure.

weekly

[SIGNALS WEEKLY] Identity-First Intrusions and AI-Driven Attack Surface Shifts

The login was real. The control plane did the rest. Storm-2949 is the ugly part: one Entra ID identity can turn into SaaS theft and Azure abuse. Nobody owns this until incident day.

podcast

[PODCAST] ANALYST YELLS AT CLOUD

Get closer to the people who understand where threat actors are today — and where they are likely headed tomorrow.

forecasts

[FORECAST] Iran-Linked Cyber Risk Is Real. The Evidence Bar Is Harder (Updated: 2026-05-14)

The forecast is 29%, but the operational risk is still worth preparing for this week.

weekly

[SIGNALS WEEKLY] Edge Access, False Flags, and Emerging AI Attack Surfaces

The edge box blinked. PAN-OS, Ivanti, Teams lures, ClickFix, AI agents. Different doors. Same ugly pattern: access keeps hiding in the plumbing. The boring surface became the breach path.

forecasts

[FORECAST] Will Akira trigger a week-long hospital disruption by end of 2026? (Updated 2026-05-11)

We’re revising the Akira hospital disruption forecast down to 2%. The risk is real, but the question is narrower than it looks.

forecasts

[FORECAST] Device-Bound Sessions Are Coming. Defaults Are the Hard Part.

“Secure by default” sounds great until it meets BYOD, VDI, federated SSO, and the help desk exception list from hell. Device-bound sessions help. Waiting for every SaaS vendor to flip the default is not a strategy.

weekly

[SIGNALS WEEKLY] Patch Cliffs, Supply Chain Drift, and Soft DevOps Underbellies

The industry keeps treating emergency patches like a finish line. Meanwhile, exposed control panels, self-managed DevOps boxes, and forgotten appliances are still out there collecting bad decisions like loyalty points.

forecasts

[FORECAST ] Iran’s Cyber Window Is Still Open—But the Qualification Clock Is Now the Hardest Adversary (Updated 2026-05-05!)

Iran cyber isn’t quiet. The problem is the scoreboard. Every recycled leak and nuisance outage wants to become “critical infrastructure impact” before the evidence has its pants on.

gametheory

[GAME THEORY] UAT-4356/Storm-1849: When Patching Is Not Eviction

“We patched it” is not an eviction notice. On edge boxes, that sentence has been carrying way too much emotional weight.

weekly

[SIGNALS WEEKLY] Edge Persistence, Covert Networks, and Supply-Chain Drift

Edge appliances are fun because the industry treats them like appliances. Patch it. Reboot it. Declare victory. Meanwhile the implant is sitting there like: “great maintenance window, see you next Tuesday.”