JODOR insights · Articles
Cybersecurity articles. Clear thinking for difficult questions.
Practical guidance for people who own risk, build defences and need to decide what happens next.
Threat Horizons 2026–2027: what we saw, and what comes next
What JODOR sensors recorded inside Saudi Arabia, what the main global and regional studies found in 2026, and five things we expect in 2027.
From managed detection to managed deception
Half the attackers JODOR recorded were on no public blocklist. This article explains why deception finds them, and how you can receive a list of your own attackers without installing anything.
Machine-speed attack TTPs: what attackers did on JODOR deception systems
A technical read of 2,207 attackers over 56 days: timing, exploit families and CVEs, MITRE ATT&CK techniques, and the YARA rules JODOR uses to catch them.
Inside JODR aMDR: sensors, deception and AI agents
How the system is built, how each alert moves from a fixed rule to a fast model, an expert model and finally a person, and what the numbers showed after 15 days of live operation.
Are we already breached? What a compromise assessment tells your board
Most boards are afraid to ask the question. Here is what an evidence-led compromise assessment can tell decision-makers, and what happens when the team finds something.
Crown jewels first: how we scope a red team engagement
A useful red team exercise starts with business priorities, clear rules and a safe way to learn. Here is how to turn critical assets into a focused, responsible test.
Stop asking who attacked us? — three better questions
Attribution can be uncertain and slow to change a decision. These three practical questions help security teams turn threat information into defensive priorities.
Alert fatigue is a people problem caused by tools
Alert fatigue is not a failure of analyst commitment. It is a signal that detection design, context and operating practices need attention.