Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#llm
Newest first
The EU AI Act for Security Teams: What Actually Applies to You
The AI Act is a product-safety regulation, not a security framework, but it lands on security teams anyway. Risk tiers, Article 15 cybersecurity duties, GPAI obligations, the phased timeline, and what a SOC running LLMs should write down.
MCP for the SOC: Connecting AI Assistants to Threat Intel Without Getting Owned
The Model Context Protocol lets an AI assistant call your threat-intel lookups and case tools directly. Here is what MCP actually is, the SOC workflows where it pays off, and the guardrails you need before tool output starts steering your analyst's copilot.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note