My Projects

I build tools, training, and guidance that help security practitioners sharpen their craft.

REMnux

I created REMnux to make it easier for people to examine malicious software. What started in 2010 as a small project has grown into the go-to environment for malware analysts worldwide. This free, open-source Linux toolkit bundles hundreds of community-built tools into a distro that just works, allowing analysts to focus on investigation rather than installation.

Incident responders and reverse engineers can get REMnux as a dedicated virtual machine, run it as a container, or add it to an existing compatible system. To connect the toolkit to AI workflows, I released the REMnux MCP server, which lets AI agents use REMnux tools to analyze malware.

Cybersecurity Training

I created the Reverse-Engineering Malware course at SANS Institute to help others enter this field. The course originated from a paper I wrote in 2001 that systematized the analysis process. Over two decades later, I continue to update it as the primary author, keeping up with the evolution of malware techniques. Many of today's incident responders got their start analyzing malware in this class.

I also realized that technical skills aren't enough—security professionals need to communicate effectively to be heard. To fix this gap, I created Cybersecurity Writing: Hack the Reader. This SANS course teaches security professionals how to create content that drives action. I wrote about the philosophy behind it when I released the course.

AI Defense Matrix

I co-authored the AI Defense Matrix with Sounil Yu as the "security for AI" companion to his Cyber Defense Matrix. It helps security leaders find gaps, assign ownership, and select controls to defend AI systems, and it helps vendors explain their value and plan product strategy.

Existing AI security frameworks each cover one slice of the work, such as naming the AI components to protect or ranking application risks. Sounil and I combined those slices into a single grid of eight AI asset classes mapped across the six NIST CSF functions. I explained the thinking when we introduced the matrix.

Cyber Company Profiles

I also created Cyber Company Profiles, which independently analyzes the market positions and product strategies of hundreds of cybersecurity companies. The profiles answer the questions I kept asking as a security buyer and product leader, such as where a vendor is taking its portfolio and whether a startup will still be around in a few years.

Cyber Company Profiles puts every company through the same questions and the same scoring scales, so scores stay comparable across vendors. Ask a generic AI assistant those questions and the answers change with each run. AI produces each profile autonomously from cited public sources, and every claim links to the source behind it. I wrote about the approach when I launched the project.

Templates and Frameworks

I've published a set of templates that give security teams a running start on reports and briefings. The set includes report templates for incident response, cyber threat intelligence, security assessments, and malware analysis, plus briefing templates for updating executives. You can adapt them to your organization instead of starting from a blank page.

I've also published frameworks for product strategy decisions. My Security Product Creation Framework organizes the questions to answer when building a security product, and I've shown how to score a vendor's defensibility as AI drives down the cost of building software.

Community Presentations

I speak at industry events to share what I've learned about cybersecurity strategy and tactics. Here are some of the talks with videos available for you to view:

• How to Keep Your Cool and Write Powerful Incident Response Reports (RSA Conference): What frameworks and checklists are available to help professionals rein in the chaos of incident response and deliver useful and actionable reports?
• Whoa, You've Been the CISO for 3 Years—Now What? (RSA Conference): What opportunities are available to CISOs who decide to stay in their roles after making an initial impact? Co-presented with Yael Nagler.
• Writing Effective Threat Reports (SANS Summit): How can security professionals create effective threat reports to inform a diverse set of stakeholders?
• How Security and Privacy Teams Break Barriers Together (RSA Conference): How can security and data privacy teams collaborate to strengthen their respective programs? Co-presented with Edy Glozman.

This Blog

I've been writing on this site since 2010 as a way to think out loud and share resources with the community. I've explored a variety of topics, including malware analysis, security leadership, artificial intelligence, and more. I've also published cheat sheets that condense many security and IT concepts into actionable references.

Writing is how I make sense of the industry. I hope you find something in the collection that helps you do the same. If you want to receive my blog posts by email, subscribe to my newsletter. And if you want to wander around, read a random article or search for something specific.