The human in the loop. Cyber agent pilot.
Cybersecurity, AI & data science leader — 20+ years building production cyber-analytics platforms across enterprise, defense, and federal.
I build production-grade cyber data and analytics platforms — applying AI/ML, data science, and cloud engineering to defend networks and turn high-volume telemetry into decisions. Ph.D. in Computer Science, 20+ years across enterprise, defense, and federal environments.
Offline/air-gapped LLM fine-tuning, MCP & agentic AI workflows, and ML-based anomaly detection on live network telemetry.
Real-time situational awareness, threat detection at scale, and cyber-topology visualization for analysts and operators.
Large-scale analytics pipelines, cloud data engineering on AWS/GCP, and ML modeling over messy, high-volume data.
A step-by-step walkthrough of Exploit-DB 52704, the PHP2Shell PoC for CVE-2026-109618, run on a Ludus range modelling a small company. Covers the vulnerability theory, the full exploit chain from recon through credential theft to vault access, and what five sensors caught and missed.
cybercveludusphpphp2shell
Read more →Dependency review is rightly built around security patches. Every upstream release also ships capabilities we could adopt. A Go 1.22 routing example shows how a small refactor can remove a dependency, and capscan, a Dependabot companion built on GitHub Agentic Workflows and running in a public demo repository, makes capability review a routine part of every update, and the same review runs out of band as an agent skill. It closes with lessons from building agents that read untrusted input.
supply-chaindependenciesgoaiagents
Read more →Part 2 adds a Wazuh SIEM on its own SOC VLAN, then reviews the whole build carefully, including a version pin meant to keep the agents in step with their manager that ended up upgrading all five past it.
cyberludusclaudecyber-rangeproxmox
Read more →Part 1 of a running log of building a cyber range by describing it to Claude Code connected to Ludus. Covers installing Ludus, deploying a segmented six-VM range from a paragraph of description, tapping its traffic passively, and generating realistic analyst activity for the tap to capture.
cyberludusclaudecyber-rangeproxmox
Read more →Introduces Breadcrumb, a small daemon-free tool that records where each opencode session lives, the git state of its workspace and a gist of the last prompt, so you can find and safely resume work across machines.
aiagentsopencodedeveloper-toolstypescript
Read more →