Perj Blog

Are humans the final attack surface?

This graphic from the Mandiant M-Trends 2026 report has stuck with me since I first saw it. It shows the breakdown, for cloud intrusions that they investigated,..

Markus De ShonAug 29, 20263 min read

What could abundant AI do for Blue Team?

In a recent post, I argued that models have become highly capable in the Security domain, and that we need to take the threat posed by them seriously. In this p..

Markus De ShonAug 21, 20265 min read

Rigid defenses will break

by Markus De Shon In any hype cycle there is some truth, which will survive the Trough of Disillusionment. In Security specifically, we here at Perj are convinc..

Markus De ShonAug 13, 20264 min read

Does C.I.A. need to D.I.E.?

I (Markus De Shon) attended a great talk by Sounil Yu: "The DIE Triad: The Past, Present, and Future of Security" (you can watch it on YouTube). He gives a sobe..

Markus De ShonAug 11, 20262 min read

Is FIM just compliance theater?

One of the challenging things about building a File Integrity Monitoring (FIM) product is overcoming the low credibility that FIM has with Security teams. FIM h..

Markus De ShonJul 29, 20266 min read

Linux syscalls open, openat and openat2

On Linux, when you are collecting filesystem events using bpftrace (which uses eBPF), you may get an error something like this: ERROR: No matches for tracepoint..

Markus De ShonJul 17, 20265 min read

What makes File Integrity Monitoring hard?

What could make it better? Businesses that operate under compliance regimes (especially PCI, FedRAMP and HIPAA) are more or less required to buy and operate FIM..

Markus De ShonJul 10, 20261 min read

Why work on Persistence?

And why *only* Persistence?When you think about the ATT&CK chain, the natural choice is to work on Initial Access. It's better to prevent attackers from getting..

Markus De ShonMay 19, 20261 min read