Case Studies

From CMDB to CAASM: Operationalizing Asset Intelligence

The gap between where most enterprises are on asset intelligence - a CMDB with varying degrees of staleness and completeness - and where the security...

Why Divergent Teams Drive True Security Collaboration

When people ask me what makes the Resolution Intelligence Cloud different from other security intelligence platforms, I usually start with the data...

Detecting Advanced Persistent Threats (APT) via Sequences

Sophisticated adversaries design their individual actions to be unremarkable. A single failed authentication followed by success - routine. A process...

How Continuous Security Monitoring Exposes Blind Spots

There is a framework for thinking about what you know and don't know about the security state of your environment that I find consistently useful. It...

LLM Grounding: Why RAG Transforms Enterprise AI Security

The most common failure mode I observe in LLM deployments for security operations is not hallucination in the classic sense - making things up. It is...

Cybersecurity Partners: Building Trust & Shared Value

I want to use this post to say something I do not say publicly often enough.

AI Governance in Security: Human In or On the Loop

"Human in the loop" appears in virtually every AI governance in security conversation in security today — typically as a reassurance that humans...

What AI Agents Taught Me About the Autonomous SOC

When I talk about agentic AI and the path toward an autonomous SOC at Netenrich, I try to be specific rather than visionary - because the specificity...

Why The Unified Security Data Lake Multiplies Everything

When we built the Resolution Intelligence Cloud, one of the early decisions that shaped everything else was committing to a Unified Data Model - a...

The True Vision Behind Cyber Risk Quantification

The Moment I Understood What We Were Really Building

About two years into the Netenrich 2.0 build, I had a conversation with one of our senior data...

NLP: Operationalizing AI Threat Detection

There is a specific inefficiency in how most organizations consume threat intelligence that I noticed early in Netenrich's security journey and have...

Bootstrapping and Maximizing the Cybersecurity Budget

The decision to rebuild Netenrich without raising outside capital in 2018 was deliberate, and I want to explain the reasoning — not to celebrate...

Adversary Path Modeling: Proactive Threat Modeling

Lateral movement is one of the most important adversary techniques to detect - and one of the hardest. Here is why.

The Biggest Flaw in Security Operations Architecture

There is a structural mismatch at the heart of most enterprise security operations that I find myself returning to constantly. Understanding it...

Using Graph Analytics for Lateral Movement Detection

There was a specific moment in an early customer engagement that changed how I thought about the security intelligence problem. We were analyzing the...

The Flywheel of SecOps Automation and Domain Memory

In conversations with security leaders, I often ask a question that produces a thoughtful pause: when your most experienced security analyst leaves,...

Turning Cyber Threat Intelligence Into Action

There is a specific moment in any security investigation when context changes everything. The analyst is looking at an alert. The raw data tells them...

How Innovation Gets Valued Among Cybersecurity Vendors

I want to tell the OpsRamp story honestly, because it contains a lesson about how enterprise technology markets work that every builder should...

Entity Resolution: The Foundation of Cross-Source UEBA

Early in the Netenrich 2.0 build, one of our data science leads surfaced a problem that seemed simple and proved to be genuinely hard: why...

Being the Underdog in the Security Operations Center (SOC)

Let me tell you something I mean without any false modesty: I genuinely love being the underdog.

What Machine Learning Threat Detection is Good At

After six years of applying machine learning to security operations problems at Netenrich, I want to share a grounded assessment of where ML...

GenAI: Building a Foundation for AI in Cybersecurity

When I talk about Netenrich's use of large language models and agentic systems, I sometimes get a specific question: how did you move so quickly?

Why Classification Fails in Security Data Analytics

When we started building the Resolution Intelligence Cloud in 2018, one of the first major investments we made was in something that would never...

How We Built a Team of Top Cybersecurity Talent

When I committed to making Netenrich a data-first, intelligence-first security company in 2018, I did something that made some people question my...

Left-Shifting Security Data Engineering Changes Everything

There is a pattern in how security programs try to improve detection quality that I have observed consistently, and that consistently produces...

What Losing My Company Taught Me About Cyber Resilience

I want to tell you a story I don't talk about often enough. Not because it is painful, it no longer is. But because the lessons in it are the ones...

Beyond CMDBs: Modernizing IT Asset Management (ITAM)

The configuration management database is one of those enterprise systems that almost everyone has and almost no one fully trusts. I say this not as a...

Digital Tone: A New Approach to Digital Risk Protection

Most security frameworks describe the enterprise as a collection of assets: servers, endpoints, cloud instances, applications, users. You protect the...

The A.C.T. Framework for Vulnerability Prioritization

Security teams face a persistent vulnerability prioritization problem. At any given moment, there are more alerts, more vulnerabilities, more threat...

Cyber Risk Management: Fix the Roof Before the Rain

Most security frameworks describe the enterprise as a collection of assets: servers, endpoints, cloud instances, applications, users. You protect the...

Attack Surface Management: One Question CISOs Must Answer

Ask any CISO in any organization of any size: do you know your complete attack surface right now?

Starting Over: A Blueprint for SOC Modernization

In 2018, I had just watched OpsRamp find its home at HPE. Six years of building a genuinely cloud-native IT operations platform - designed from the...