Long-form Analysis
Threat Research
Technical intrusion analyses and threat actor research from vendor and community teams — the reports behind the headlines, with attacker tradecraft, TTPs and indicators. Separate from Security News, which covers fast-moving daily coverage.
Loading threat research…
Publication rhythms differ widely: The DFIR Report publishes a small number of very deep intrusion reports per year, while vendor teams post weekly. Use the source filter rather than scrolling if you are looking for a specific team.