Technical papers on the methodologies and tools we publish. Analysis results are separate: those go into Reports.
Sits above ATT&CK, NIST CSF and FAIR: it takes their output and produces a reasoned order for which control comes first, against a specific actor. Four axes, ADV, IRR, CC and DDT, are weighted per actor rather than generically. A worked example against a Sandworm profile puts immutable backups in Tier 1 and awareness training in Tier 4, against that actor, not in general.
Describes the platform behind our tracking work: collection, processing, modeling and visualization in one continuous workflow instead of five tools passing data back and forth. Observations are stored as an entity graph in which every edge carries evidence, so repeated observations strengthen an existing entity rather than fragmenting the dataset with duplicates.
Every published paper carries its license in the header. Cite the version you worked from: the models are revised and older revisions stay available.
The frameworks in production, with annotated chains and tracked clusters, are on the Research overview and in the actor dossiers.
Pick what you want to hear about. One address, no cadence you did not ask for.