Rohan Amin

Watching the Mythos debate play out. Some see a watershed moment, others see hype. Fair argument to have, but if you're responsible for cyber, product, or technology, it's not the argument worth your time. The reality is that AI capability keeps getting better. So whether Mythos is the inflection point or just another step matters less than whether your org can do the boring work at speed. Time from patch availability to deployed in production. Percentage of deploys with automated tests, phased rollout, and automatic rollback. Time from an upstream fix in an open source dependency to running in prod. These look like cyber metrics. They're really a measure of whether your organization can change at the speed this work now requires. Cyber resilience needs this. Agentic AI needs this. Any product team trying to ship real value needs this. The orgs that can't do the boring work at speed won't be able to keep up. Spend less time arguing about the model. Measure the maturity of your deployment pipeline.

And the paper was much more than just "the kill chain."  It was three models, the second of which documented for the first time an approach to assemble intrusion sets (in the paper called "campaigns"), and the third illustrated the indicator lifecycle. (Thread)

18/ People like @PahDoh and Hien! Countless others. None of this would have happened without them. Life long relationships forged over years of hard work and dedication to our craft and to our nation. You know who you are - thank you!

17/ Above all, this is a story about a team well beyond Eric, Mike and I - an incredible set of colleagues who became close friends.

10 years ago this month, Eric Hutchins (aka @killchain), @mikecloppert and I published a paper to share analytical tradecraft we had been using to defend networks against Advanced Persistent Threats - aka the “cyber kill chain”. bit.ly/killchain. (Thread)