Learn about DeepTempo & AI for cyber defense

LogLM Is the Jev Detections Need

Jev, TypeSafe's new System One model, may help your detection engineering. It cannot do your detecting. Why detection needs a System One pretrained on telemetry, and why Jev and Vigil go together like peanut butter and chocolate.

DeepTempo now in Austin

DeepTempo has taken space at Capital Factory in downtown Austin. Why we chose it: the defense and innovation community we met at Supernova, the city's cyber scene, and John Van Lowe.

Agentic SOC vs. Autonomous SOC: an uncanny valley?

Is the autonomous SOC just an agentic SOC with more agents?

Branch61G Weekly. The force starts upstream

Branch61G Weekly for September 11, 2026: Cisco Firewall Management Center flaws exploited by three clusters, one of them deploying Qilin ransomware; an unauthenticated GitLab file read probed within hours of disclosure; the Magento StyleSmuggler zero day; and a fourth N-able N-central hotfix. The theme is the upstream systems trusted to direct everything below them.

Branch61G Weekly. The sleeper picks

Branch61G Weekly for September 2, 2026: a new SonicWall SMA 1000 zero-day chain, a JFrog Artifactory authentication bypass that mints admin tokens, a BGP hijack that pushed a poisoned Virtualizor update onto hypervisors, and an unauthenticated PaperCut chain with confirmed customer hits. The first touch looks like nothing; then the sleeper wakes up.

Agent skills and Ice Houses: Notes from AI Cyber Alliance San Francisco

The AI Cyber Alliance met at Workato in San Francisco on August 26 for two talks on the same problem from opposite ends. Aron Eidelman, Senior Developer Relations Engineer for security at Google, opened with the Vulnpocalypse: AI raises code throughput and vulnerability discovery at the same time, and triage cannot keep up, with remediation running 20 to 70 days behind. His answer is to shift left and then shift down into the coding agent itself, using reusable skills for threat modeling, TDD, and secure coding, plus a git push hook that catches high-severity findings before they land. Kendall Miller of DPLYD followed with "Local AI: Why Now?", tracing the American ice trade to 1914, the year manufactured ice overtook harvested ice and the price fell twelvefold, and argued inference is hitting the same crossover. He closed with LLMFIT, a terminal tool that scores which models actually run on the machine in front of you. Across both talks the same conclusion: security has to be a first-class citizen in how AI gets adopted, not a check that happens afterward.

Tokenomics Begins Upstream

Waymo does not put Gemini in the real time driving path. It uses an encoder for perception and control, and reserves the reasoning model for the rare and semantically strange. The AI SOC has the same shape. An encoder only foundation model running next to the data lake or pipeline forwards roughly thirty percent of volume to the SIEM, and an agent harness that assigns a model per task handles what follows. Seventy percent less ingestion, and more than eighty percent less work reaching people.

Three dogs, a live range, and the channels that already belong

Branch61G Weekly for August 25, 2026: the Zimbra Collaboration SNMP command injection under active exploitation with a three day KEV clock, a maximum severity Oracle WebLogic flaw, an implant that disables the endpoint agent, and FTP banners used as dead drops. Plus first results from the DeepTempo range, where LogLM caught every instance of C2, lateral movement and exfiltration we staged.

The crew you trust, and the control planes attackers already live in

Branch61G Weekly for August 18, 2026: a China nexus operator turning a VMware vCenter syslog flaw into root and then hiding behind cron jobs that impersonate VMware itself, SAP Commerce Cloud exploitation attempts, a GeoServer SQL injection, and Clop's PLM data theft claims. The theme is internet facing control planes that already have trust.

Branch61G Weekly: Teachings from the Thickets (Notes from Building an Open Source AI SOC)

Branch61G Weekly for August 11, 2026: SonicWall SMA1000 moving from zero day to ransomware KEV with custom Java implants, a Progress Kemp LoadMaster command injection under mass probing, Head Mare turning TrueConf servers into trojanized update points, and a Metabase SQL injection used for customer data theft. The theme is the enterprise edge, where trust is thickest and visibility thinnest.

Failures or Failsafe?: A Perspective from the Arena of AI Detection Evals

DeepTempo’s cybersecurity foundation model, LogLM, played an integral role in discovering errors in a variety of datasets it was being evaluated on. Beyond proving superior performance and exposing critical flaws in public data, these rigorous evaluations and data quality checks power continuous model improvements.

Building the Evaluation Factory Behind LogLM: TempoRange

Building the evaluation factory behind LogLM, TempoRange leverages three distinct engines to generate rich, accurately labeled datasets for security models. The Scripted Range executes reproducible kill chains across the full spectrum of MITRE ATT&CK techniques with guaranteed 100% label accuracy. To capture real-world conditions, the Detonation Range safely runs live open-source malware inside a sealed environment with egress containment. Finally, the ARTEMIS Range utilizes Stanford’s autonomous red-team agent to simulate emergent, AI-powered novel attacks at machine speed. Together, these engines feed a unified data labeling and log correlation pipeline to ensure high-precision labeling across every layer.