About

Operator

Agentic Threat Lab is run by Cidari, an independent researcher and principal of a security consulting practice. The lab is a solo operation: research direction, honeypot operation, rule authoring, and dataset curation are all one person's work. (Full bio to follow.)

Research principles

1. Everything mapped. Every rule and dataset entry is tagged to a pinned MITRE ATLAS release; proposed-but-unadopted techniques are labeled as such.
2. Everything validated. Rules pass sigma-cli schema checks and backend conversion in CI; rules derived from the honeypot are backed by captured telemetry.
3. Honest measurement. False-positive methodology is published alongside rules — including when numbers get retracted.
4. Passive by design. Honeypots never initiate outbound connections. The lab generates no attack traffic toward third parties.
5. Primary sources only. Write-ups cite vendor engineering blogs, papers, spec text, and CVE records — not aggregator content farms.

Ethics statement

• Honeypots are passive-only: they listen and record, never initiate outbound connections.
• Findings affecting the Poppy protocol or third-party products are reported through private vulnerability-reporting channels before publication here.
• The lab publishes no exploit code. Detection content, deception tooling, and sanitized datasets only.
• Datasets are sanitized before release; raw logs are never published. See Datasets.

Contact

• Email: security@cidari.ai
• Vulnerability disclosure: see security.txt. Reports affecting third parties are coordinated privately before anything is published here.
• New research: Atom feed