Reading a failed control
What a broken access check looks like once the request has already succeeded.
Articles
Technical notes, analysis, and practical observations from the lab.
Published articles
Privacy boundaries in logs
Which fields belong in an investigation log, and which ones should never be copied.
Models are not the control
A detection model can rank events. It does not replace the control that should have blocked them.