[ index // projects ]

WORK

Disclosures, tools, and published research. Everything here is public and reproducible once disclosure or publication clears it.

2026.06.26 CVE-2026-58196: SSRF in ToolHive, host-side and past the sandbox A remote MCP server can drive the ToolHive host into fetching internal URLs, reaching cloud instance metadata from outside the container isolation the tool is built to enforce. 2026.04.04 AutoMCP: Elastic Purple Team MCP Server An MCP server that extracts security alerts from Elastic, analyzes them, responds, and runs counter-reconnaissance.

[ index // peer-reviewed ]

When the Analyst Scans for the Attacker: Subverting Agentic LLM Security Operations in OT Networks SHIELD-AI @ ECML PKDD 2026, Springer CCIS to appear

KEYSER: Stateful Adversarial Campaign Evaluation of ML-Based Intrusion Detection in Industrial Automation IEEE ETFA 2026 to appear

Adversarial Robustness Evaluation of a Multi-Layer OT Intrusion Detection System via Automated C2 Red Teaming IEEE ETFA 2026 to appear

Characterizing Domain Shift in PROFINET Intrusion Detection: A Multi-Site Ground-Truth Evaluation IEEE WFCS 2026 published CoAnalyst: An Agentic LLM-Based Cybersecurity Analyst for Industrial Control Systems IEEE WFCS 2026 · co-author published An Integrated Testbed for MITRE-Mapped Attack Emulation in Industrial Control Networks MDPI Sensors, 2026 published An Operational Hybrid SIEM Framework for OT Anomaly Detection MDPI Sensors, 2026 published A SIEM-Based Framework for Multi-Layer Data Collection and Anomaly Detection in OT Networks IEEE IDAACS 2025 published A Testbed for Cyber Attack Emulation and AI-Driven Anomaly Detection in Industrial IoT and OT Networks IEEE IDAACS 2025 published Mapping the MITRE ATT&CK Framework to Modbus Cyber Attacks in Industrial OT Networks IEEE ICEST 2025 published