Available for threat model reviews, retainer advisory, and custom threat intelligence research. Work is scoped around your environment and threat profile — not generic frameworks. Engagements are kept selective to maintain quality and independence.

View consulting services →

Research time varies significantly by scope. Smaller reports represent multiple days of active analysis — static and dynamic malware analysis, infrastructure pivoting, detection rule development, and write-up. Larger investigations like the Arsenal-237 and Zero Trace series, which involve many samples and extensive hunting pivots, took a month or more to complete.

All analysis runs on a dedicated home lab server — self-built and self-maintained — running the VMs, sandboxes, and tooling required for safe malware analysis. That infrastructure has real hardware and ongoing operational costs that come entirely out of pocket.

None of this is paywalled because the research is more valuable when it reaches defenders directly. But it is not free to produce.

Organizations can sponsor individual reports, a batch of reports, or on a monthly basis. Sponsors receive logo placement and a link on sponsored content. Sponsorship does not influence research conclusions or methodology — editorial independence is non-negotiable.