f7i7nZd█ w%h█a9tM bAr█eXaPkBs#.4 b█u0iLl3dH wVhEaKtE hFo8lTd█s2.C

I never got around to my post-trip notes from Black Hat (RSA: Summer Camp Edition). Instead, I was building this. FT3 2.0 isn't a bigger list—it's a different shape. Flat fraud taxonomies force one label to carry three separate facts: where the behavior sits in the lifecycle, who or what was authorized to act, and what was actually abused. Pick one; the other two never get written down. That shows up downstream as duplicate techniques, false coverage confidence, and crosswalks that don't translate. FT3 2.0 records all three independently. 261 techniques, 119 analytics, 105 detection strategies, 69 controls, 3,100+ relationships. You can walk from behavior to the telemetry that exposes it, to the analytics, to the control. That turns FT3 from a catalog into an operating layer, one agents can reason over rather than a framework analysts just read. Full writeup: https://lnkd.in/gbhKBiZM Black Hat notes: pending. Possibly forever.

FT3 2.0 is here. It will not be published on GitHub. In May, I wrote about why FT3 had to be open. I still believe that. Those positions sound like they conflict. They do not. FT3 1.0 needed to be open because the fraud industry needed a shared language. It could not be a private diagram understood by only one team. It had to be visible, inspectable, and extensible. It had to move across teams and institutions without depending on one person being in the room to explain it. Open source gave it that path. People found it. They used it. They built on the ideas. Other frameworks emerged. The industry started treating fraud tactics and techniques as a category worth developing. That was meaningful. Open access made FT3 available. It did not create the contribution loop required to keep it moving. Lesson learned: Distribution is not community. The meaningful contributions came another way: through direct relationships, partnerships, and trust groups. They came from people willing to share what they were seeing because they trusted that the people on the other side would do the same. That matters because FT3 2.0 is not simply the next version of a static matrix. It is becoming a living, agentically driven operating layer: a system that can ingest intelligence, reason across techniques and relationships, identify gaps, and propose changes for practitioners to review. A system like that cannot improve through passive consumption alone. Use has to produce evidence. Evidence has to produce learning. And some of that learning has to come back into the system. That changes what distribution needs to mean. FT3 2.0 will remain free. No paid membership. No paywall. No industry tier decides whether your organization belongs in the room. And contribution does not only mean writing code. It can mean bringing forward a technique the framework cannot describe, sharing operational evidence, challenging a definition, contributing a detection, or showing where the model breaks when it reaches real work. A community you can only buy into is a market. A community defined by who you are is a club. A trust group is defined by what you give. FT3 1.0 will remain open on GitHub. Anyone can use it, fork it, or build on it. FT3 2.0 will remain free to the people doing the work and willing to improve the system as they use it. The mission did not change. The mechanism did. I wrote the full explanation here: https://lnkd.in/gQk5wsiv

Amazing presentation from Roman Y. Sannikov at RISE-X NYC hosted by Team Cymru and JPMorganChase.

The US government recently required Anthropic to withdraw Fable 5 and Mythos 5 from all customers due to a reported "jailbreak." The jailbreak involved prompting the model to review a codebase and address flaws, which revealed several minor, previously known vulnerabilities that

Remember when AWS bills were the scary ones? https://t.co/J5SCM6SUXO

Finally, a manager for my interns. https://t.co/9Susi3fBEu