Detection: articles and guides

An intrusion detection system (IDS) monitors traffic or hosts for attacks and raises alerts. The types (NIDS, HIDS), detection methods, and IDS vs IPS.

A clear explainer on hidden and anonymous proxy servers: what they are, how attackers and insiders use them to evade security controls, the data-exfiltration and command-and-control risks they create, and the egress filtering and detection techniques that surface them.

A defensive, educational explainer on DLL injection: what a dynamic link library is, why attackers abuse DLL injection for evasion and persistence, the conceptual mechanisms (without weaponizable code), and how to detect and defend against it with EDR, image-load monitoring, signing and hardening.

Anthropic’s Claude API and SDK can now emit OpenTelemetry spans for Messages API requests, tool uses and Managed Agents sessions (beta) — to any OTLP backend. For security and audit leaders that is the missing evidence layer: you cannot audit agent behaviour you never recorded. A third-party, docs-grounded read of what it traces (real span + attribute names), why it matters for AI audit and detection, and the one new data-exposure surface it opens — full-content spans that put prompts, tool results and PII into your observability stack.

Security operations center best practices for 2026: a 10-point checklist on people, runbooks, ATT&CK coverage, automation, metrics and SOC maturity.

A SOC maturity model measures how developed your security operations are, from ad hoc alert-chasing to proactive, automated and threat-informed. The levels, the dimensions to assess and how to improve.

Threat intelligence APIs provide programmatic access to indicators, reputation data and context about threats. What free options can do, where they fit, and how to use them well.

Deception technology — honeytokens, canary accounts and decoy systems — turns an attacker's own reconnaissance into a high-fidelity alarm. What the techniques are, how they work, and where to start.

CISA’s 2026 guidance recommends honeytokens, canary accounts and decoy systems to catch living-off-the-land attacks. A deployment roadmap with Sigma rules.

IP reputation APIs tell you whether an IP address is associated with malicious activity. What they check, where they fit in a security stack, and how to evaluate free and paid options.