π¦ @scythe_io @grimmcyber, Sr Advisor @IST_Org & NatSec Sr Fellow, Co-Fdr @ICS_Village, @c2_matrix co-creator, USMA Science Board, Angel Investor, US Army Offcr
π¦π΄
Joined May 2017
- Tweets64.9K
- Following503
- Followers20.3K
- Likes122K
Bryson π¦ retweeted
Don't forget! Final deadline for Call for Papers for WWHF @ Mile High 2027 is today, Oct. 30! Submit yours here: wkf.ms/4fUdiKA
You should only drink the water I'm selling.
Bryson π¦ retweeted
Info on how to your badge to reflash it: bsideslisbon.org/2026/badge/β¦
Bryson π¦ retweeted
Register today for BSides Pyongyang 2026!
eventbrite.com/e/20035382839β¦
Bryson π¦ retweeted
This is adversary emulation you run by talking to it.
Point Claude at a fresh CISA APT41 advisory, connect it to SCYTHE over MCP, and watch. No UI, no scripts. Just plain English.
In a single conversation, it:
- Mapped 27 APT41 techniques straight from the advisory
- Built a 56-step emulation and staged it
- Ran it live on three Windows hosts
- Read the verdict from CrowdStrike and Elastic: credential dump blocked in 4 seconds, five techniques with no signal
- Prioritized the open, high-severity exposures sitting behind those gaps
- Drafted the detections, flagged its own weak rule as not deployable, and packaged a ServiceNow ticket for the detection engineer
- Caught a Microsoft Defender connector that looked healthy but had ingested nothing for 19 days
That is the full loop, CTI to test to coverage to fix to retest, driven by language, not labor.
This is the new realm of MCP enabled testing. You have to see it to believe it.
SCYTHE. Act Before You Need to React.
#AdversaryEmulation #MCP #ThreatInformedDefense #DetectionEngineering #SCYTHE
Bryson π¦ retweeted
π₯ I'm hiring a Staff Security Researcher at Rapid7π₯
When a critical vulnerability starts getting exploited in the wild, my team figures out what's really happening and whether defenders should panic or breathe. You'll be doing fast n-day analysis from patch diffs, writing @metasploit modules, and helping shape where the framework goes next. Oh, and some zero-day hunting too.
You should be at home in a debugger and comfortable talking about your research in public. Youβd be joining some absolute legends in @stephenfewer , @_CryptoCat , Deral Heiland, Brendon Watters, and Jack Heysel (that's not even the entire list π).
Bonus if you've contributed to Metasploit in the past or have been using AI to speed up exploit dev.
Remote, US. Apply below or DM me with questions.
careers.rapid7.com/jobs/stafβ¦
You want to prioritize the exact actions to fix your risk exposure. We've spent a lot of time working the analytics to get you there @scythe_io.
Wdyt?
π¦
A security dashboard should answer one question: what do we do next?
Guided remediation answers it in order of importance and impact.
SCYTHE builds that guidance into every layer:
1) TestOps: each drill-down ends in a recommended next action, tied to the row-level evidence behind it, not just a red cell.
2) RiskOps: exposures and gaps come with prioritized remediation, ranked by how much risk each fix actually removes.
3) Dashboard: a single βwhat to fix firstβ layer across Defense Score, MITRE Coverage, Control Effectiveness, MTTD, Exposure Reduction, and Threat Preparedness.
Because it is one shared engine, a single fix or added test moves every metric it touches, so your teamβs effort lands where it improves posture the most.
Remediation stops being a backlog and becomes a prioritized path.
#SecurityPosture #CISO #MITREATTACK #ExposureManagement #SCYTHE
Bryson π¦ retweeted
BREAKING NEWS: The supreme Marcus Hutchins (@MalwareTechBlog) has been democratically elected with 99.9% vote as the (Un)Supreme Keynote for #BSidesPyongyang2026.
#OpenToWork
Talking MCP functionality AND security with @MalwareJake. #unicorndispatchlive
The "S" in MCP doesn't stand for Security.
Bryson Bort and Jake Williams break down the Model Context Protocol on Unicorn Dispatch LIVE: a live purple team demo, plus how to use its power without handing attackers the keys.
Recap: hubs.ly/Q04CtkkY0
Keynoting @Bsideslisbon this week! π¦
Lisbon, we are ready. π΅πΉ
This Thursday, SCYTHE Founder and CEO Bryson Bort opens BSides Lisbon 2026 with the morning keynote.
Expect a candid take on where adversary emulation, threat intelligence, and real validation are headed, and why proving your defenses beats assuming they work.
π Thursday, October 29
π€ 09:30 WET
π AuditΓ³rio FMD-UL, Lisbon
If you are on the ground, come find us. Prove it.
#BSidesLisbon #BSides #AdversaryEmulation #ThreatEmulation #OffensiveSecurity #SCYTHE
Going LIVE in 30 minutes at VeteranSec #VetSecCon to talk about how military vets can start their own security companies. Some sneak peeks at my slides. π¦
