iiinova — where your digital self keeps evolving

David J. Bianco @davidjbianco.bsky.social · 09/10/2026

If you're using EvidenceForge on MacOS, check out the alpha of our new GUI: EvidenceForge Studio. It bundles eforge, Python, and other dependencies into a standalone app, no repo checkout required! (Linux and Windows coming soon) github.com/Cisco-Talos/...

github.com

Release EvidenceForge v2.2.0a1 · Cisco-Talos/EvidenceForge

First alpha of the planned 2.2.0 release. Introduces EvidenceForge Studio, a standalone macOS application, and portable scenario and pack releases. Existing CLI and native chat-skill workflows rema...

020

David J. Bianco @davidjbianco.bsky.social · 09/10/2026

Livestreaming executions is the most Bread & Circuses thing since Bread & Circuses. And it's harder than ever to afford the bread. #NoKings #VoteBlue

010

David J. Bianco @davidjbianco.bsky.social · 06/10/2026

I keep my clock in 24hr mode so at least once a day I can feel 13:37.

010

David J. Bianco @davidjbianco.bsky.social · 01/10/2026

If you're attending the SANS DFIR Summit, @letswastetime.bsky.social and I are giving a workshop: "Know Normal, Catch Abnormal: Hands-On Baseline Hunting". It's a sample of our new FOR668 #ThreatHunting class, hot off the presses and free with admission! www.sans.org/cyber-securi...

sans.org

SANS DFIR Summit & Training 2026

Obtain hands-on, practical skills from the world's best instructors by taking a SANS course at SANS DFIR Summit & Training 2026.

110

David J. Bianco @davidjbianco.bsky.social · 01/10/2026

This is next level. Our #cybersecurity cons mostly just have lock-picking or social engineering. @defcon.bsky.social you listening? Also, congrats to @astrokatie.com! I have literally no idea how to this, but it's kinda awesome.

010

David J. Bianco @davidjbianco.bsky.social · 30/09/2026

Whew! @letswastetime.bsky.social and I just turned in our new #ThreatHunting course to SANS. Can't wait to finally get this in front of students!

010

David J. Bianco @davidjbianco.bsky.social · 27/09/2026

Let's be honest: my look could probably use a good gay-up.

001

David J. Bianco @davidjbianco.bsky.social · 26/09/2026

They measure theirs in meters because typical European homes don't have as much land as American yards do. Watering the front meter takes a lot less hose.

020

David J. Bianco @davidjbianco.bsky.social · 20/09/2026

WTF? Straight out of some sort of crappy tower defense game. "Buffoons TD 6"

000

David J. Bianco @davidjbianco.bsky.social · 18/09/2026

Bold of you to assume that just because a judge ordered them to be produced that they will actually be produced.

0591

David J. Bianco @davidjbianco.bsky.social · 16/09/2026

Just put in an order for more Pyramid of Pain stickers and buttons. I've got some speaking engagements coming up this month and next, so if you see me, be sure to ask for one. Don't be shy!

000

David J. Bianco @davidjbianco.bsky.social · 14/09/2026

✅️ Earlier detection of invisible or impossible behavior. Validation now considers deployed sources, host roles, sensor placement, observation settings, collection windows, and selected output formats before generation begins. Evidence gaps warn or fail early so scenarios can be quickly corrected.

000

David J. Bianco @davidjbianco.bsky.social · 14/09/2026

✅️ Faster, clearer scenario authoring. Focused eforge schema commands provide exact field definitions, while runtime inventories expose valid roles, personas, formats, and IDS signatures. Dedicated agent skills help authors find and repair the relevant objects much more quickly.

100

David J. Bianco @davidjbianco.bsky.social · 14/09/2026

✅️ Self-describing output bundles. Every generated bundle includes its authoritative scenario and manifest. Bundles can be evaluated without separately locating the original scenario and retain the information needed to understand or reproduce the run.

100

David J. Bianco @davidjbianco.bsky.social · 14/09/2026

✅️ Reusable environment packs. Industry packs capture sector-specific applications, roles, traffic, and activity patterns. Organization packs define a consistent environment. Reusing an org pack makes the resulting datasets look like different incidents collected from the same real environment.

100

David J. Bianco @davidjbianco.bsky.social · 14/09/2026

✅️ Resumable generation. Automatic checkpoints, graceful suspension, and easy recovery make long runs easier to operate. Interrupted jobs can resume safely without starting over, while improved progress reporting, resource forecasting, and performance make large datasets more practical.

100

David J. Bianco @davidjbianco.bsky.social · 14/09/2026

✅️ Cross-platform SMB2/3 activity. Model file-share activity across Windows and Linux clients/servers, including storage topology, authentication, mounts, access controls, and file operations. Correlated Zeek smb_mapping, smb_files, and files logs provide complete SMB investigations.

100

David J. Bianco @davidjbianco.bsky.social · 14/09/2026

✅️ Greater realism. Endpoint, identity, network, application, and IDS evidence now agrees more closely on actors, credentials, processes, timing, network sessions, artifacts, and lifecycle boundaries. Analysts can follow investigative pivots with fewer contradictions and more source-native behavior.

100

David J. Bianco @davidjbianco.bsky.social · 09/09/2026

September 1 is officially the first day you can order Pumpkin Spice Cybercrime without being gauche.

010

David J. Bianco @davidjbianco.bsky.social · 07/09/2026

Due to the immediate and constant criticism of their first concept, the White House has released a revised version of the Space Force uniform design. Old version: Space Nazis This version: Still Space Nazis, but at least they're hilariously ineffective.

020

David J. Bianco @davidjbianco.bsky.social · 07/09/2026

Everyone says they look like the Star Wars' Empire, but the Space Force logo puts me more in mind of Star Trek's mirror universe Terran Empire. But it gets even better. Apparently they're inspired by the Starship Troopers movie, of all things. Miss the point much? www.newsweek.com/space-force-...

newsweek.com

Donald Trump’s Space Force uniform has unexpected inspiration

A Space Force uniform shared by Trump cited Starship Troopers as its inspiration, drawing fresh attention online.

020

David J. Bianco @davidjbianco.bsky.social · 03/09/2026

Wait... you're trying to get me to retire??

010

David J. Bianco @davidjbianco.bsky.social · 03/09/2026

The going rate on one of the trust groups I'm in is like $0.25 IIRC. Seriously, though, seeing all the higher-ranking search hits just means people are finding it useful. If it's good for the field, I'm happy!

010

David J. Bianco @davidjbianco.bsky.social · 03/09/2026

Feel free to call it whatever you like, I guess? #PyramidOfPain

190

Reposted by David J. Bianco

Katie Mack @astrokatie.com · 02/09/2026

There are endless studies showing this and also the financial and societal benefits of universal basic income and or housing-first policies but the U.S. never goes for any of it because it would require allowing the poor to receive benefits that the rich consider “undeserved”

20591013162

David J. Bianco @davidjbianco.bsky.social · 01/09/2026

Scientists: "Whatever. I'm not your mom." wapo.st/4zTH7nG

061

David J. Bianco @davidjbianco.bsky.social · 26/08/2026

Struggling to find the right combination of model and reasoning effort for your task? Balancing effectiveness, speed, and cost seem too confusing? Check out my latest article on balancing all these factors for your SOC tasks. blog.talosintelligence.com/choose-your-... #LLM #cybersecurity #SOC

blog.talosintelligence.com

Choose your fighter: Balancing competing requirements to select models for your AI SOC

Selecting a model for your security operations center (SOC) and digital forensics and incident response (DFIR) tasks is important, but selecting the best one is more involved than you might think.…

021

David J. Bianco @davidjbianco.bsky.social · 25/08/2026

Tired of hearing about Hugging Face and OpenAI? Me too! But consider: what happens when your SOC LLM refuses in the middle of an incident? In my latest @talosintelligence.com blog post, I have some thoughts on operational sovereignty and paths to achieving it.

000

David J. Bianco @davidjbianco.bsky.social · 25/08/2026

At the risk of sounding like a comic book nerd (guilty), I hear a lot of people are wondering if Atrocitus has just shown up in Season 1, Episode 2. I don't know, but all I can say is, it ain't called *Green* Lanterns. #lanterns

030

Reposted by David J. Bianco

Rob Fuller @mubix.com · 23/08/2026

Heard this fantastic quote today: “Mentorship is about making equals (or betters), not followers. If your mentee wants to be a follower it will never work. If your mentor just wants followers it will never work. Find someone that wants to be or to build an equal”

A step of people symbols with arrows pointing at each other with the words “we mentor” below it

1143

David J. Bianco @davidjbianco.bsky.social · 22/08/2026

It's a different field, of course, but this is how I feel about my #cybersecurity career. I love what I do, and that makes things a lot easier, but I wouldn't be where I am today without a lot of help. That's why I try to give others a hand up when I can. When one of us does better, we all benefit.

020

David J. Bianco @davidjbianco.bsky.social · 10/08/2026

Are you ever tempted to just stand in line for your own event, as a prank? Like, grab one of your books from shelf and be all like, "I'm so excited to finally meet him!"

1400

David J. Bianco @davidjbianco.bsky.social · 07/08/2026

It's amazing how quickly we went from "OMG, an AI autonomously broke out of its sandbox and attacked another company" to "Oh, I guess $AI_COMPANY wants in on the our-model-can-hack-too bandwagon".

000

David J. Bianco @davidjbianco.bsky.social · 04/08/2026

New research from some of my Talos colleagues. How do threat actors prompt their LLMs? Sounds like the setup of a dad joke, but finding the answer yields valuable insights.

130

David J. Bianco @davidjbianco.bsky.social · 01/08/2026

Just to put this into perspective, this would be about $11.97 when adjusted for the US median household income of about $84000 (US Census Bureau, 2024). For that money, you or I could buy a couple of Frappucinos. Musk can buy a country.

000

David J. Bianco @davidjbianco.bsky.social · 31/07/2026

More bodies there than at the inauguration and the recent fair combined.

000

David J. Bianco @davidjbianco.bsky.social · 31/07/2026

Movie pitch: a Terminator reboot, but the difference is Cyberdyne Systems publishes a humblebrag press release about how Skynet broke containment.

040

David J. Bianco @davidjbianco.bsky.social · 30/07/2026

You don't have an animated, interactive visualization of your breach? Bro, do you even IR?

110