I'm a UK-based cybersecurity enthusiast who's been pulling threads in the security space for the better part of five years. This blog started as a personal notebook — somewhere to write up what I'd learned before I forgot it — and gradually turned into something more deliberate.
I spend most of my time across offensive security disciplines: red team methodology, Active Directory abuse, web application testing, and chasing flags on HackTheBox and TryHackMe. On the other side, I'm deeply interested in how defenders think — detection engineering, SIEM tuning, and making sense of the mountains of telemetry that modern environments produce.
Threat intelligence is another thread that runs through a lot of what I write. I find the adversary side of the problem genuinely fascinating — how campaigns are constructed, how infrastructure is spun up and torn down, and what the forensic artefacts tell us after the fact.
I write here because I believe technical knowledge should be accessible without being dumbed down. If something I've written saves you an hour, helps you understand an attack chain, or gives you one new query to add to your detection library — that's the goal.
I don't post on a fixed schedule. When something is worth writing up properly, I do. Everything here is published under my own name and reflects my own views — not anyone else's.