UMBRASEC is an independent defensive security practice based in Australia. It publishes detection engineering, threat analysis, and open-source defensive tools in the open - work you can read, check against its sources, and run in your own environment - and takes on scoped advisory work for businesses that want the same method run with them.
Technical, defender-focused writeups: detection-engineering guides with rules you can run, breakdowns of real techniques mapped to MITRE ATT&CK, mitigation guidance, and honest analysis of current threats and CVEs. Every factual claim is tied to a primary source - vendor advisories, ATT&CK, CVE records, or reputable reporting.
No working exploits, no malware, no jailbreak libraries, no offensive tooling. The research describes how attacks work only to the depth a defender needs to detect and stop them. This is a deliberate scope choice: shipping functional attack material would make the project a liability, not an asset. I study how attacks are actually run so defensive advice is not cargo-cult, but offensive notes live separately and are not part of this practice.
You won't see report counts, disclosure tallies, or client logos here - padding a record with numbers nobody can verify is the opposite of the point. A site advertising figures it can't substantiate is a red flag, and rightly so. The approach here is the boring, honest one: publish genuinely useful work and let it be checked.
UMBRASEC is run by 0xdev1, an independent security practitioner based in Australia. I have spent seven years in governance, risk and compliance and in detection engineering, including law-enforcement environments. That work does not belong on a billboard, which is why this site uses a handle rather than a legal name. The independent practice is new. The underlying trade is not.
What matters for trust isn't the name on it - it's whether the rules run, the sources check out, and the analysis holds up. All three are things you can verify yourself.
I use AI tools to draft, maintain, and convert material. Technical claims stay tied to primary sources. Detections, recommendations, and anything that would go to a client or a board are reviewed and owned by me.
Alongside the published work, UMBRASEC takes on scoped defensive engagements - Microsoft 365 and Entra ID reviews, detection engineering, and virtual-CISO advisory. The services page sets out the method and the shape of each engagement. Scoping conversations are no-obligation, you meet me on a call, and the work is scoped in writing before any money moves. Advisory is defensive: no red teaming, and not a 24/7 incident-response retainer.
If a detection misbehaves, a citation is wrong, or an analysis is off, that's exactly the feedback this project wants. Open an issue on Codeberg or email 0xdev1@umbrasec.dev. Corrections make the next version better and are credited.
Standing commitments: defensive scope only · every claim sourced · free to read, no paywall or email gate · honest about what exists and what doesn't.