Cyber Machines https://cybermachines.io/ Essays on security automation: detection engineering as a software discipline, alert triage, automated response guardrails, severity scoring, and asset inventory. en Tools That Survive Contact With Your Environment https://cybermachines.io/tools-that-survive-your-environment/ https://cybermachines.io/tools-that-survive-your-environment/ Fri, 31 Jul 2026 00:00:00 +0000 Procurement Security tooling is usually evaluated on capability and fails on integration. The questions that predict whether a product will work are mostly about your estate, not the product. Machine Speed Attacks, Human Speed Decisions https://cybermachines.io/machine-speed-attacks-human-speed-decisions/ https://cybermachines.io/machine-speed-attacks-human-speed-decisions/ Sun, 26 Jul 2026 00:00:00 +0000 Strategy The tempo gap between automated attacks and human response is not closed by hiring. It is closed by deciding in advance, which means the real work happens before the incident. Asset Inventory Is the Security Programme https://cybermachines.io/asset-inventory-is-the-security-programme/ https://cybermachines.io/asset-inventory-is-the-security-programme/ Sun, 19 Jul 2026 00:00:00 +0000 Foundations Every security capability silently assumes a correct inventory. When the inventory is wrong, detection, vulnerability management and response all degrade in ways that are hard to attribute back to the cause. What a Severity Score Actually Tells You https://cybermachines.io/what-a-severity-score-tells-you/ https://cybermachines.io/what-a-severity-score-tells-you/ Sat, 11 Jul 2026 00:00:00 +0000 Vulnerability Management A CVSS base score describes a vulnerability in isolation, by design. Treating it as a priority queue is the most common and most expensive misreading in vulnerability management. Automating Response Without Automating Mistakes https://cybermachines.io/automating-response-without-automating-mistakes/ https://cybermachines.io/automating-response-without-automating-mistakes/ Fri, 03 Jul 2026 00:00:00 +0000 Automation Automated response fails in a specific way — it executes a wrong decision faster and more consistently than a human ever could. The design problem is bounding blast radius, not writing the playbook. The Alert Nobody Reads https://cybermachines.io/the-alert-nobody-reads/ https://cybermachines.io/the-alert-nobody-reads/ Wed, 24 Jun 2026 00:00:00 +0000 Operations Alert fatigue is usually described as a volume problem. It is closer to a precision problem, and the fix is unpopular because it means deleting detections you spent money building. Detection Engineering Is a Software Discipline https://cybermachines.io/detection-engineering-is-software/ https://cybermachines.io/detection-engineering-is-software/ Fri, 12 Jun 2026 00:00:00 +0000 Detection Detections are code that runs in production against hostile input. Teams that treat them as configuration keep rediscovering why software engineering invented tests, review and version control.