// The Threat Brief

Field notes from the front lines.

Threat intelligence, incident retrospectives, and practical defense guides from SENTINEL's senior security engineers. Published every Tuesday and Friday.

Threat Intel

Ransomware in 2026: what 200 incidents taught us

Patterns, initial-access vectors, and the controls that actually stopped the bleeding.

Cloud Security

Five misconfigurations we see in 80% of AWS audits

From public S3 buckets to wildcard IAM policies — the same five things, every time.

SOC

Cutting alert fatigue: from 10,000/day to 30 that matter

How a detection-engineering program reduced noise by 99.7% while improving coverage.

DFIR

Active Directory attacks: the 7 paths we see most

Kerberoasting, AS-REP roast, NTLM relay, and how to detect each in your SOC.

Zero Trust

ZTNA in 90 days: the playbook we use with mid-market clients

Phased rollout that replaces VPN without breaking the business. Tested in 40+ engagements.

Offensive

What our red team found in 100 production environments

A statistical look at the most common exploitable findings — and how to fix them.