Everyone Has A Plan Until They Get Punched In The SonicWall
Why any organization with a public IP has to plan for un-patchable zero-day exploitation, not just targeted attacks.
Ryan Basden
Writing on security, technology, and related topics.
Latest posts
You Can't Just Publish Partial Exploits Anymore
Taking a 'safely' disclosed WordPress RCE most of the way to a full unauthenticated exploit chain with public research, a patch diff, and an LLM, and the rest with a public PoC.
One Home for Everything I Write
Consolidating my scattered writing under one roof, without giving up digital ownership.
What To Do With Bad Ideas From People Who Also Have Good Ideas
On consuming valuable ideas from people whose other beliefs you find repugnant, and why avoidance is the choice to be passive.
Infosec Training Is Weird Now
Enshittification comes for us all.
How to Ensure Your Purple Team Fails Miserably
The misaligned incentives, on both the client and consultant sides, that doom most purple team engagements before they start.
Ocean's Eleven Heists In a Louvre Four World
What real-world heists and insider-threat data reveal about who actually breaks into buildings, and what a physical penetration test is worth.
How Shadow Incentives Harm Real Security
The hidden incentive to make more money, not to reduce risk, that pushes the security industry toward compliance theater.
You Will Definitely Get Phished, So Stop Simulating It
Why phishing simulations punish employees for a problem they can't solve, and what actually reduces the risk of a successful phish.
Lessons in Project Management
A largely unfiltered and slightly refined response to upper management's annoying idealisms.
Less Pager For Persistence
New research for using `less` as a persistence mechanism.
Stop Breaking Your Feeds
RSS is supposed to be for the readers, not you.
C2 via Legitimate Services
A collection of legitimate services and how to use them for evil.
Link Blogs
A nice way to share without writing an essay.
Recommended Blogs
A collection of blogs/feeds I read on a regular basis.
Burnout Recovery and Prevention 101 (Part 0)
An introduction to burnout and how to recover from it.
Mastodon, Musk, and Mythbusting: The Case for Federation
The old internet was better anyway.
Secure Messaging for Paranoid Realists: Vol. 2
Reasons for not using Conduit anymore.
Learn Exploit Development for Free
A free guide to free resources for learning exploit development.
Secure Messaging for Paranoid Realists
...like me.