Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Compliance
Newest first
The EU AI Act for Security Teams: What Actually Applies to You
The AI Act is a product-safety regulation, not a security framework, but it lands on security teams anyway. Risk tiers, Article 15 cybersecurity duties, GPAI obligations, the phased timeline, and what a SOC running LLMs should write down.
The Cyber Resilience Act for Software Vendors: A Field Guide
The CRA turns secure development, SBOMs and vulnerability handling into legal obligations for anything with digital elements sold in the EU. Here is what is in scope, what the essential requirements say, and why September 2026 matters before December 2027 does.
NIS2 vs DORA vs GDPR: Untangling EU Cybersecurity Regulation
Three EU regulations, three different scopes, one confused compliance team. A clear map of who each one covers, where they overlap, and what to fix first.
Why EU Data Hosting Matters for Security Tooling
Your IOCs and telemetry contain personal data. Sending them to a US cloud service is a data transfer with legal strings attached. Here is what that means for your tooling choices.
DORA Explained for Security Teams: What Changes in Practice
The EU Digital Operational Resilience Act translated into engineering terms: who is in scope, what incident reporting really requires, TLPT, and why your vendor register just became a regulated artifact.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note