Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
Articles
49
Categories
9
Tags
142
Latest
July 10, 2026
#scoring
Newest first
Vulnerability Management
Exploit Prediction with EPSS: What the Score Means and What It Does Not
EPSS gives every CVE a daily probability of exploitation in the wild. Here is what the model actually predicts, how to read scores versus percentiles, and where the number stops helping.
6 min
Threat Intelligence
The IOC Lifecycle: Aging, Expiration, and Why Old Indicators Hurt You
Indicators of compromise have a shelf life. How to score, decay, and retire IOCs before your stale blocklist starts paging on-call for legitimate CDN traffic.
6 min
Engineering
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note