Independent cybersecurity research

Follow the
evidence.
Strengthen
the defense.

Understand what happened.
Know what matters. Build what comes next.

Explore the threat atlas ↗Open the case files →

RESEARCH / CONTEXT / ACTION↓

Historical incident atlasDrag to explore

Europe in focusCountry reference locations · 2000–2024

Affected-country records

DOCUMENTED HISTORY. NOT LIVE ATTACKS.Open the atlas ↗

100Source-led historical case files

3,152Mapped historical incidents

31Research chapters & field guides

166Affected countries & territories

THE VISUAL RECORDAll 117 source plates ↗

01 / 1988↗

Floppy disk holding the Morris Internet Worm source code at the Computer History Museum

The 1988 internet worm exposed a missing security focal pointGreenlight 02 / 2014↗

Heartbleed forced the web to assume its encryption keys were exposedGreenlight 03 / 2020↗

SolarWinds sign on the company's office building

A backdoored SolarWinds update reached thousands of networks at onceGreenlight 04 / 2024↗

Security advisory graphic for CVE-2024-3094, the XZ backdoor

A slow SSH login exposed a years-long backdoor in xz UtilsGreenlight

01 / THE EVIDENCE DESK

Real incidents. Lasting lessons.

All case files ↗

Hydro industrial workers wearing protective helmets and face shields

NORSK HYDRO / COMPANY PHOTOGRAPH

Operational resilience / 2019

When the network goes down,
the business still has to work.

Hydro’s response puts the human side of incident recovery in focus: manual operations, coordination and clear communication.

Inside the Hydro case file ↗Photograph: Norsk Hydro · illustrative company image from its retrospective

Mandiant diagram connecting the X_TRADER compromise to the 3CX software supply chain

supply-chain / 2023

3CX demonstrated a supply-chain compromise that began with another supplier

Mandiant's investigation traced a trojanized desktop application back to a prior software compromise.

Read the evidence ↗Image: Mandiant / Google Cloud

Vulnerability / 2014

Heartbleed forced the web to assume its encryption keys were exposed

OpenSSL's April 2014 advisory disclosed a memory-read flaw that had been live in the library for over two years before anyone found it.

Read the evidence ↗Image: Greenlight

02 / INTERACTIVE CHRONOLOGY

Different decades.
Familiar failure modes.

Move through the archive. Connect the incidents to the standards, disclosures and defensive shifts that followed.

Explore the timeline ↗

1988The internet learns to respond↗2014Trust meets a broken heartbeat↗2020The supplier becomes the route in↗2024Identity moves to the front line↗

03 / THE SOURCE MATERIAL

Look closer.

Enter the evidence room ↗

Figure from Mandiant’s investigation into UNC5537 and Snowflake customer data theft — Original figure from Mandiant’s June 2024 investigation; it reflects the report’s investigative scope. Image: Mandiant / Google Cloud ↗Source image · credit and context below

Original research / Mandiant

A diagram is useful.
Its context is essential.

See how investigators reconstructed the credential trail in the Snowflake customer campaign. Read the boundaries of the claim, not just the headline.

Open the case file ↗

04 / PRACTICE THE RESPONSE

Reading is the start.
Make the next decision.

Build a baseline, work through an incident scenario, or navigate the six NIST CSF functions.

Open your workbench ↗

01Security baseline12 controls · saved locally↗02Response scenariosPractice defensive decisions↗03The research libraryFoundations to emerging threats↗

05 / VULNERABILITY DESK

Known exploitation. Clear next action.

Search the catalog ↗

CISA KEV Snapshot 2026.09.14 · 1,710 records

CVE-2026-76461Cisco Secure Email Gateway SQL Injection Vulnerability↗CVE-2026-85706GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability↗CVE-2026-42018JFrog Artifactory Improper Authentication Vulnerability↗

The Patch & Proof briefing

A little less noise.
A lot more context.

Source-led security reading, delivered with perspective. One publication. Your choice to subscribe.

Explore the briefing ↗Your privacy →

Follow theevidence.Strengthenthe defense.

Real incidents. Lasting lessons.

When the network goes down,the business still has to work.