Why Phishing Defense Needs Software Engineers

If you’ve worked in security for any amount of time, you know that phishing is the attack vector that just won’t quit. It’s evolved from Nigerian prince emails to sophisticated credential harvesting operations powered by Phishing-as-a-Service (PhaaS) platforms like Tycoon 2FA. The attackers have leveled up—and honestly, most defenders are still playing catch-up.

Traditional approaches to phishing defense aren’t cutting it anymore. We need to think like software engineers.

The Problem with Traditional Phishing Defense

Most organizations approach phishing defense reactively. An email comes in, gets flagged (maybe), an analyst investigates, and if it’s malicious, they block the sender or domain. Rinse and repeat.

Open Season: Domain Profiling

I hope you enjoyed the last post about CZDS, but I wanted to write another one explicitly related to my experience and how you can profile a domain address.

All of this derived from a tool I wrote called domain-profiler (and the other blog gave me an itch).

So here we go, let’s talk about how you can approach profiling a domain.

What Is a Domain?

To start, let’s just set an example. I’ll use my blog letsautomate.it in this post since it is the most apt to this situation.

Detecting Phishing with Microsoft Email Headers

I also wrote a companion post on the Sublime Security blog: Getting started with Microsoft email headers for security. It covers these headers with hunts written for Sublime’s MQL. A copy of the original post is archived at the bottom of this page.

Original Post: Getting started with Microsoft email headers for security

Originally published August 27, 2026 on the Sublime Security blog. Archived here in case the original is removed.

Whether you’re a SOC analyst or a detection engineer, understanding Microsoft email infrastructure is advantageous for investigating and resolving email-based threats. If you’re working at a Microsoft shop, you may have already seen Microsoft’s recent Phishing actors exploit complex routing and misconfigurations to spoof domains blog. That post gives a great overview of how adversaries are taking advantage of misconfigurations that can happen when a SEG (secure email gateway) is placed in front of Microsoft, as we can see from this line:

Open Season: CZDS

This post was also published in The Thor Collective’s Dispatch.

What up nerds? I was reading this awesome post from LP titled Open Season: Certificate Transparency (I highly recommend you read this too) and it forced me to write this blog about a free and open (mostly) service which can add another layer of context / enrichment to your threat intelligence toolbelt.

Before I get into CZDS, first I want to set the stage of how we can view this data along with the other sources (mentioned in LPs blog and many others).

Beyond the Prompt: The Social Costs of Generative Artificial Intelligence

The rapid commercialization of generative artificial intelligence has produced extraordinary value for technology companies while systematically externalizing costs onto society. Co-authored with J. Scott Christianson, this article provides a review of these externalities across three domains: environmental, human health, and digital infrastructure. The environmental burden includes massive energy and water consumption alongside ecologically destructive mining for rare earth elements and accelerating electronic waste.

The human toll encompasses a documented pattern of AI-induced mental health crises, including suicide and self-harm linked to anthropomorphic chatbot design, raising novel questions of product liability. The digital commons face degradation through industrialized data scraping that has effectively stripped platforms of their primary legal defenses. Our argument is straightforward: the AI industry’s business model is predicated on a fundamental market failure—the privatization of benefit and socialization of cost.

The Agentic Web: A New Internet Built for Agents, Not Browsers

Every time you sign up for a new service, you hand over your data, create yet another set of credentials, and agree to terms you didn’t read. You do this dozens of times across dozens of platforms. Each one owns a piece of you – your preferences, your purchase history, your social graph – and good luck getting any of it back. The internet as we know it was built for humans to browse. I believe it’s time we build one where agents act on our behalf.

How I Use LLMs for Security Work: Part 2

I previously wrote a blog for THOR Collective Dispatch about some basic examples of different approaches when it comes to LLMs. It was cool and I hope it truly helps those starting out but I wanted to follow up and share some other more specific examples, including more “advanced” patterns that have worked for me over the past year or so.

We’ve all seen the scope, complexity and rise of usage of LLMs from products which integrate them, to all new product categories to ClawdBot. If you’re not familiar with all the facets of LLMs that’s okay but before I dive into these more advanced use cases, I think it’s advantageous to understand some terminology (at a high-level) when it comes to LLMs.