So excited to announce the next chapter: @wirespeed_ is now part of @CoalitionSec (@SolveCyberRisk) where @jreynoldsdev and I will be taking what we've built to the next level for Coalition's > 100K policyholders! "Fastest growing cyber insurer acquires the fastest MDR." 👈 sums it up nicely!

Imagine an implant that, when analyzed statically, reveals everything about its intent. Thats what this is, something very different than implants designed to have only primitive functions with the attacker’s intent hidden behind server side logic or in the mind of its operator. And of course, unless the intent is something self-destructive like Stuxnet, it’s going to need to send data it collects *somewhere.* One might call that a “C2 server.”

🧠 Humans think in algorithms. Claiming you need a human to triage a detection is admitting you don’t have a good facsimile of that algorithm in your code. Admittedly, a big part of that process is data normalization. If you have messy, fuzzy, or incomplete data, it can’t even enter into your algorithm. 📈 This week in particular, as we onboarded a few new customers, I saw a ton of messy, incoherent, and truncated data coming out of BIG NAME cybersecurity vendors’ APIs. 😕 It shouldn’t be this hard. They’re not helping. Sometimes, all I want to see are process trees with hashes and the metadata where it came from. You can spare me your threat actor pet names and wordy descriptions that don’t match the ACTUAL DATA you spit out of your product in the form of detections. 🗑️

This is @wirespeed_

When your MDR sells you a Service Level Agreement (SLA) or Service Level Objective (SLO), what they're really selling you is prioritized access to human compute (i.e. their SOC analysts). Just a couple problems with that: 1. It assumes detections come into the MDR's SOC pre-triaged at the correct severity, i.e. what if a "medium" is really a "critical" but you don't know until after you assess it? 2. It's the MDR acknowledging they're slow. ⚡wirespeed turns this model on its head: - All alerts are triaged in milliseconds - Our uptime is publicly measured by a third party at status.wirespeed.co - We assess the severity on the way OUT of triage, not on the way IN, so it's correct. (Plus we're so much faster and still cheaper than those other MDRs, why are you even still thinking about those archaic severity-based SLAs???)

We set our own new fastest time record!

People talking about adversaries bringing their own EDR as a C2. We have known the whole time EDR and RMM tools are … C2. 👇

Actual conversation yesterday, sanitized. 😇😎

I’m torn. I 💜 our light mode UI during the daytime, dark mode at night, but 100% of the time on mobile is dark mode for me!

Are you a ticketing platform or a purpose built solution? I regularly get questions from customers: “do you learn from cases we close, because my current provider just thanks me for feedback, closes the case, and sends me a repeat alert a few weeks later.” Yes. Yes, we do learn!

‼️ It's getting to the point where we no longer care if a login used MFA (unless FIDO2 Passkeys). We care more about where, how, timing, user agent, what happened afterwards, etc. If you're "in the trenches" working suspicious logins in the Microsoft world, you'll feel this one!