Engineering writing
Long-form posts about the things we got wrong, the things we changed our minds about, and the specific mechanics of catching an attacker inside a Linux kernel. No press releases.
Your ATT&CK coverage matrix is lying to you
Most coverage matrices measure the wrong thing. Here is what we changed to make ours mean something, including the part where it got worse.
Mohamed Nofal · Founder&CEO · 11 August 2026 · 4 min read
Detecting container escape without drowning in privileged-pod alerts
Why "this pod is privileged" is posture and not detection, and how correlating the mount set with the subsequent exec turns it into a real signal.
Ali Awwad · 11 August 2026 · 4 min
Fileless execution on Linux, and why your FIM will never see it
A walk through memfd_create-based execution, what it looks like from the kernel, and the exact eBPF signal that catches it.
Mohamed Genina · 11 August 2026 · 4 min
Keeping an eBPF sensor under 1% CPU, and what we gave up to get there
Ring buffers, in-kernel filtering, per-class sampling and the specific tradeoffs behind the sensor's resource profile.
Mohamed Nofal · 11 August 2026 · 5 min
We threw away our event schema and rebuilt on OCSF. It cost a quarter.
Why we replaced a perfectly functional internal schema with OCSF v1.3, what it cost, and the three things it bought that we did not anticipate.
Mohamed Nofal · 11 August 2026 · 4 min