Campaign postmortem
Monthly
One recent agent, MCP, or package incident, worked end-to-end from the catalog angle. Retro-match logic and rotation steps.
Field Notes
Agent and MCP risk, written up as we find it.
Sekeye's public journal. Campaign postmortems, engineering deep-dives, response playbooks, and a weekly digest of what's moving in the ecosystem. Not press releases. Not marketing filler.
One email a week when there's signal. Unsubscribe from any issue.
Latest
Latest posts.
Engineering deep-dive· 7 min
Would we have caught the last 60 days?
We took the agentic incidents of the last two months and asked, honestly, which Sekeye control would have surfaced each one, and which phase that control actually belongs to. Three surfaced cleanly, two were made discoverable, zero were stopped.
Campaign postmortem· 6 min
Shai-Hulud: 796 packages in one evening
The Shai-Hulud npm worm's second wave backdoored 796 packages inside a single evening. Here is how the mechanic works, why traditional tooling missed it, and what a fleet operator should do the next time it lands.
What's coming
Four content types, one honest cadence.
No filler, no fluff. Missing a week is fine. A Threat Weekly with nothing to say isn't Threat Weekly, it's marketing.
Engineering deep-dive
Bimonthly
How Drig's collectors, the signed catalog, and retro-match actually work. Written by the engineers who built it.
Response playbook
As needed
Evergreen guides: rotating tokens after an npm compromise, cleaning MCP configs, isolating an exposed IDE extension.
Compliance breakdown
Quarterly
One regime per post. Which clauses ask for what evidence, and how the Sekeye catalog and inventory map to them.
Why we don't call it a blog
Because it isn't one.
Blogs are calendar-driven. Field Notes is signal-driven. If the catalog has nothing to add this week, nothing publishes. If a new campaign lands on Tuesday, the postmortem ships when it ships, not on schedule.