1/ Today @JulianVoeg and I published research on suspected China- and India-nexus espionage actors targeting Pakistani law enforcement. s1.ai/spy2flags

Having previously posted that this was an interesting rabbit hole, a spam account liking that post a couple of weeks ago reminded me that I never actually explained why. So here's a brief version - maybe something we should blog about in more detail in the near future...

Latest from me and my colleague Carter Church - How to build agents from evaluations.

A short read if you are building an agent for your security program and have questions of where to start or how to measure success.

sentinelone.com/blog/building-…

[1/2] I had the pleasure of giving a lecture at the @DefAcUK / @CranfieldUni on "Cyber Operations In and Around Conflict." Cyber operations have become a common component of today's conflicts, conducted before, during, and after kinetic hostilities.

[2/2] I covered how states use them across these phases: disruption of critical systems, cyberespionage to gain strategic and operational advantage, and influence operations to shape perceptions at home and abroad.

I am grateful to the attendees for the engaging discussions.

[1/6] Last week, @Gabeincognito and I presented at the very last @labscon_io on AI-assisted reverse engineering. Our work focuses on generating annotated disassembler databases (such as IDBs) as the output of LLM-driven analysis, instead of textual reports.

[5/6] The standard is a floor. It is the minimum an LLM-driven analysis workflow should enforce before its output is worth building on.

[6/6] We released our initial implementation of the standard: An LLM harness for reverse engineering, currently supporting IDA.

Give it a try. We'd love to see what others build on top of it!

github.com/SentineLabs/ve…

...and we're back.

@juanandres_gs with A Synoptic Sense. A talk about what cybersecurity actually is today.

"alignment is the founding lie of this [AI] bullshit"

Our long time friend and research partner, Julian Ferdinand Vögele (@JulianVoeg), brings us a deep analysis of Middle Eastern threat actors.

He is taking us on a nice stroll, revealing a fragmented yet deeply interconnected cyber ecosystem shaped by hidden relationships, shared and an increasingly industrialized approach to cyber power.

We're honored to present Katie Moussouris (@k8em0) with our Lifetime Achievement Award, for a lifetime of incredible work and contributions to the industry.

A huge welcome to our opening @labscon_io keynote speaker, the legend Professor James Mickens.

"Happiness Nullification, Intergalactic Carnage, and the Release of Multiple Frost Giants: A Sober Analysis of AI Impacts."

An honest, hilarious, and unique look into the emergence of AI

CYBERWARCON is BACK for 2026!

Registration and CFP are now officially open!

We’ll be in Arlington, VA+ virtually on November 20th, with Rob Joyce as our keynote.

cyberwarcon.com 1/x

We were finishing our investigation draft when this reporting (@razhael) scooped us. It overlaps with several of our findings and is truly worth reading. I think this is a story worth watching closely..

Thread for additional points from our analysis. 🧵

reuters.com/world/openais-…

[1/12] Stoked to be speaking at @labscon_io 2026 together with @Gabeincognito. It's the fifth edition and the last one ever, so we are bringing something we have been working on for a while.

[11/12] Same year, @Joseliyo_Jstnk (@virustotal/@Google) and I ran a workshop on how LLMs change large-scale threat hunting, from making sense of bulk VT data to building better queries.

More on the workshop:

blog.virustotal.com/2025/09/labsco…

blog.virustotal.com/2025/09/advanc…

[12/12] And now the final LABScon. If you are going, come find me in Scottsdale.