Magonia Research

If you follow my work, you know how much I harp on the base rate fallacy.

Anthropic’s marketing team has been pushing its new Mythos cybersecurity model and the volume of vulnerabilities it’s finding.

When I was first getting started in cybersecurity, MITRE's ATT&CK had only just launched and wasn't widely known.

Last September, I published "Why the EDR Telemetry Project is Misleading."

Cybersecurity and tech marketing have always loved acronyms and buzzwords.

A common reason I see for not implementing a detection is that it can be evaded or is prone to false negatives.

I recently found a great research paper on fuzzy hashing detection that's worth highlighting named Bytewise approximate matching: Evaluating common scenarios for executable files[1].

You'd be hard-pressed to find a detection engineer who doesn't know the Pyramid of Pain[1].

After my last post on EDR Telemetry, some great conversations made me realize we have a problem.

The author of the EDR Telemetry Project responded, accusing me of spreading misinformation by saying his project was for detection, that it's always only ever been about telemetry.

UPDATE - Author Response: The author of the EDR Telemetry Project responded, unfortunately accusing me of spreading "misinformation" by saying his project was for detection, that it's always only ever been about telemetry.

The response to the first article was really positive, and it highlighted something I've seen a lot: many of us in security come from backgrounds in IT, networking, or other fields that aren't pure software development.

The cybersecurity job market feels brutal right now, especially for newcomers.

Ask anyone who’s worked in a SOC long enough and they’ll tell you: debates over “true positive” versus “false positive” happen a lot.

I'm excited to announce the release of CelesTLSH CLI, a lightweight command-line interface tool for calculating, comparing, and analyzing TLSH (Trend Micro Locality Sensitive Hash) hashes.