https://threatmachines.com/ Essays on threat intelligence and threat modelling: design-time modelling, intelligence requirements, attribution, adversary infrastructure tracking, attacker economics, and tabletop exercises. en https://threatmachines.com/threat-vulnerability-risk-three-words/ https://threatmachines.com/threat-vulnerability-risk-three-words/ Thu, 30 Jul 2026 00:00:00 +0000 Fundamentals The three terms are used interchangeably and they describe different objects with different owners. The confusion is not pedantry; it shows up directly in how budgets get argued. https://threatmachines.com/a-tabletop-that-fails-is-working/ https://threatmachines.com/a-tabletop-that-fails-is-working/ Sat, 18 Jul 2026 00:00:00 +0000 Exercises An exercise that everyone passes has told you nothing. The value is in the decisions nobody could make, the dependency nobody had mapped, and the question nobody could answer. https://threatmachines.com/the-adversary-has-a-budget/ https://threatmachines.com/the-adversary-has-a-budget/ Wed, 08 Jul 2026 00:00:00 +0000 Adversary Economics Intrusions have a cost structure — access, tooling, infrastructure, labour, time and the risk of burning a capability. Controls work by moving one of those lines, and most programmes never ask which. https://threatmachines.com/infrastructure-outlives-the-payload/ https://threatmachines.com/infrastructure-outlives-the-payload/ Sun, 28 Jun 2026 00:00:00 +0000 Adversary Tracking A file hash changes for free; a hosting arrangement does not. Tracking the machinery an operation has to keep standing is slower, harder to automate, and considerably more durable. https://threatmachines.com/attribution-and-the-decision-it-changes/ https://threatmachines.com/attribution-and-the-decision-it-changes/ Sat, 20 Jun 2026 00:00:00 +0000 Attribution Naming the adversary satisfies something real, but most incident decisions are identical whoever is behind the keyboard. The useful question is which specific choice would differ. https://threatmachines.com/why-threat-feeds-go-unread/ https://threatmachines.com/why-threat-feeds-go-unread/ Fri, 12 Jun 2026 00:00:00 +0000 Intelligence Programmes Most intelligence feeds fail not because the data is bad but because nobody defined the decision the data was supposed to inform. Requirements first, subscriptions second. https://threatmachines.com/threat-modelling-is-design-work/ https://threatmachines.com/threat-modelling-is-design-work/ Thu, 04 Jun 2026 00:00:00 +0000 Threat Modelling A threat model produced after the architecture is fixed can only describe problems. Produced while the boxes and arrows are still soft, it changes them — which is the whole point.