Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Vulnerability Management
Newest first
Malicious Open-Source Packages: How They Get In and How to Keep Them Out
Typosquats, dependency confusion, hijacked maintainers, install scripts and protestware all exploit the same reflex: trusting whatever the registry hands you. How each technique works, how to vet a dependency in ten minutes, and why a release cooldown is the cheapest control you are not using.
CVSS 4.0 Explained: Reading a Vector String Step by Step
CVSS 4.0 renamed, split and added metrics, dropped Scope, and introduced labels like CVSS-BT so you know which score you are looking at. A metric by metric walkthrough of a 4.0 vector, and what changed from 3.1.
Exploit Prediction with EPSS: What the Score Means and What It Does Not
EPSS gives every CVE a daily probability of exploitation in the wild. Here is what the model actually predicts, how to read scores versus percentiles, and where the number stops helping.
Tracking Vulnerabilities in Your Stack with SBOMs
What SBOMs actually are, why regulators keep demanding them, how scanning one against a CVE database works, and where the whole approach quietly breaks.
Anatomy of a CVE: From Discovery to Your Patch Queue
Follow a vulnerability through its full lifecycle: discovery, coordinated disclosure, CNA assignment, NVD enrichment, publication, and exploitation, and learn what every field of a CVE entry really tells you.
The Vulnerabilities Threat Actors Actually Exploit
Attackers do not exploit CVEs at random. Cross-referencing actor profiles with their known exploited vulnerabilities reveals clear patterns you can use to prioritize patching.
CVSS, EPSS, KEV: How to Actually Prioritize Vulnerabilities
Patching by CVSS score alone drowns your team in criticals that will never be exploited. Here is how to combine CVSS, EPSS, and CISA KEV into a priority queue that works.
Patch Tuesday Survival Guide: Building a Monthly Vulnerability Workflow
A repeatable monthly process for Patch Tuesday: same-day triage with KEV and EPSS, patch windows by asset class, deadlines people respect, and verification that closes the loop.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note