Start here
How this site fits together.
There's a lot of research here, and it isn't obvious on a first visit where to begin or how the pieces connect, so this page is the reading order. The short version is that the site makes one argument, that security data is a data-engineering problem and mostly a solved one, backs it with evidence you can check, and then goes deep in whichever direction your question points. Every claim is labeled by how strong its evidence is, because I want you to be able to tell what I measured from what I'm only claiming.
If you only have ten minutes, read the thesis and skim one benchmark on the lab page. Everything else is depth on demand.
The map: claim, evidence, depth.
The core sections play one of three roles. The thesis states the claim; the matrix, the lab, and the research notebook carry the evidence for and against it; and the writing catalog plus the reference architectures are the depth, where the argument gets worked out topic by topic. Engagements sits apart, because it was the same method applied to a client's own environment, and it's paused while I work full-time. Everything else on the map is free to use.
A first visit in three moves.
- 1
Read the thesis, the argument that security data is a data-engineering problem, and mostly a solved one, and the three properties it holds every platform to: trustworthy, well-connected, and performant. It's a short read, and the rest of the site hangs off it.
- 2
Check the evidence: first-party benchmarks with methods and raw results posted, plus a cost model you can run against your own numbers. The Matrix is the scoring instrument behind the platform evaluations, and the research notebook keeps the open questions and the contradictions on the record, so you can check the argument instead of taking it on trust.
- 3
Go deep where your question lives, in the essay catalog, which is organized as ten pillars in dependency order, from storage formats up through detection engineering and economics, and each pillar marks its own "start here" essay so you can enter mid-stack without reading everything above it.
If you came with a specific question.
Seven three-essay reading paths, each built to answer one question a security data team actually asks, so you can read three pieces instead of eighty.
Leaving Splunk without breaking detections
The cost case, the migration trap most teams walk into, and what the timeline actually costs.
Whether you can trust your data
The quietest failures in security data, in the parsing layer and in the measurement problem underneath it.
Picking the query engine
Where each engine wins, from petabyte-scale detection down to an analyst's laptop.
When hunting becomes data science
The path threat hunters are already on, made reproducible.
Securing the AI you're deploying
One agent risk told three ways, the AI attack techniques the defensive ontology can't yet reach, and why a more capable model makes a wrong answer over security data quieter rather than rarer.
- 1The lethal trifecta, explained three ways
- 2The blind quadrant over AI systems
- 3The better the model, the quieter the wrong answer
Evidence: The ATLAS Wall: which AI controls to deploy first →
Whether your detections are telling the truth
The silent mapping failure that lets a rule compile clean and never fire, the gap between a field's shape and its meaning, and what no single tool can see about your environment.
Picking the table format
What the open stack is made of, the format decision on its production record, and the measured finding that how data enters decides more than which format holds it.
Start where your question is.
The full case, and the three properties it holds every platform to, trustworthy, well-connected, and performant.
The scoring method and the scored tables behind the evaluations, both public and free to use against your own weights.
First-party benchmarks I ran myself, with the methods and raw results posted so you can check them.
Working hypotheses and the contradictions against them, tracked in the open while the questions are still live.
Longer pieces sorted by topic, for when you would rather read the thinking in full.
I'm not taking engagements while I work full-time. This page records what the practice offered and points to the free material instead.