Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
#cve
Newest first
Tracking Vulnerabilities in Your Stack with SBOMs
What SBOMs actually are, why regulators keep demanding them, how scanning one against a CVE database works, and where the whole approach quietly breaks.
Anatomy of a CVE: From Discovery to Your Patch Queue
Follow a vulnerability through its full lifecycle: discovery, coordinated disclosure, CNA assignment, NVD enrichment, publication, and exploitation, and learn what every field of a CVE entry really tells you.
The Vulnerabilities Threat Actors Actually Exploit
Attackers do not exploit CVEs at random. Cross-referencing actor profiles with their known exploited vulnerabilities reveals clear patterns you can use to prioritize patching.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note