Field notes No. 1 — what we publish here

This page is for the long-form technical work of the Lab. The charter is simple:

• Threat intelligence. We run our own sensors and deception infrastructure, and we'll publish trends and techniques worth sharing — aggregated, anonymized, and actionable.
• Infrastructure experiments. Results from the Lab's own stack: what we tried, what it cost, what we'd do differently.
• Build retrospectives. Honest write-ups of prototypes — including the ones that became compost. Negative results are results.

Everything published here follows two rules: it has to be something we actually ran, and it has to include the part that didn't work. Vendor-neutral, buzzword-free, and written by the people who typed the commands.

First full publication is in the ground now. Check back soon.