Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Compliance
Newest first
The EU AI Act for Security Teams: What Actually Applies to You
The AI Act is a product-safety regulation, not a security framework, but it lands on security teams anyway. Risk tiers, Article 15 cybersecurity duties, GPAI obligations, the phased timeline, and what a SOC running LLMs should write down.
Your Organisation Is in a Data Breach: A France and EU Response Guide
Your data just showed up in a leak, or you just found an intruder. The GDPR clock is already running. A practical walkthrough of Articles 33 and 34, the CNIL notification, evidence, communication, credential resets and the French support ecosystem.
The Cyber Resilience Act for Software Vendors: A Field Guide
The CRA turns secure development, SBOMs and vulnerability handling into legal obligations for anything with digital elements sold in the EU. Here is what is in scope, what the essential requirements say, and why September 2026 matters before December 2027 does.
NIS2 vs DORA vs GDPR: Untangling EU Cybersecurity Regulation
Three EU regulations, three different scopes, one confused compliance team. A clear map of who each one covers, where they overlap, and what to fix first.
Why EU Data Hosting Matters for Security Tooling
Your IOCs and telemetry contain personal data. Sending them to a US cloud service is a data transfer with legal strings attached. Here is what that means for your tooling choices.
Third-Party Risk Management Without the Spreadsheet Nightmare
Vendor questionnaires are point-in-time, self-reported, and unread. Here is why the spreadsheet model of TPRM fails, what continuous vendor risk management looks like, and how DORA forces the issue.
DORA Explained for Security Teams: What Changes in Practice
The EU Digital Operational Resilience Act translated into engineering terms: who is in scope, what incident reporting really requires, TLPT, and why your vendor register just became a regulated artifact.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note