ThreatFight Research
Security research on genomic infrastructure: sequencers, lab and instrument software, bioinformatics pipelines and genomic data platforms. Every post ships its own data or code, links a primary source for each claim, and keeps a dated record of corrections.
Research
Original data, code or analysis on genomic infrastructure security.
-
Genomic infrastructure security, 2023–2026: what the public record shows
Advisories, CVEs, breaches and policy affecting sequencing instruments, lab software, bioinformatics pipelines and genomic data holders, with sources linked and caveats on figures we could not verify.
Notes
Shorter pieces: methods, tooling and reading of the public record.
Nothing published here yet.
Archive: MalCloud era
Posts from 22 March to 16 April 2026, written while ThreatFight was building MalCloud, a threat-intelligence platform. MalCloud no longer receives feature work, and our research now covers genomic infrastructure. Each post carries a banner and its corrections.
-
Why Your Threat Intelligence Context Doesn't Export
STIX bundles carry nodes and edges. Most platforms don't put analyst reasoning, confidence history or provenance into them, even where STIX 2.1 could carry it.
-
Detection-as-Code: Generating Sigma Rules from Threat Intelligence
Detection-as-code with Sigma as the intermediate format: example rules, conversion to Splunk, Elastic and Microsoft Defender queries with sigma-cli, test cases and coverage measurement.