Research at Wolfe Defense Labs is aimed at one thing: turning emerging attacker tradecraft, cloud realities, and defensive gaps into patterns we can deploy in real environments. This page surfaces a subset of that work—enough to show how we think, test, and refine.
Highlights below represent ongoing lines of research—not static whitepapers that age out in a year.
These research lanes show up in our client work, our internal detection engineering, and the tools we maintain. They evolve as the ecosystem does.
Modern persistence and command-and-control rarely look like classic malware anymore. We study how attackers live inside SaaS and identity:
Identity is the new perimeter, but it’s also the new lateral movement layer. We focus on:
Instead of chasing every new technique, we look for durable detection opportunities:
A non-exhaustive sampling of work that’s influenced how we build solutions, services, and guidance for clients. Some appear as public talks or posts; many stay private and flow directly into engineering and advisory.
Real-world analysis of how an attacker can pivot from a single compromised shared mailbox into broader M365 and data access with minimal tooling.
Testing and refining paths that avoid “obvious” signatures, including:
Not every environment gets a 24/7 SOC. We study which controls provide outsized value for lean security teams:
Research is only valuable if it changes how we design, defend, or respond. We deliberately wire lab findings back into our solutions and services.
We use research outcomes to shape what our solutions actually include—whether that’s which attack paths we test, which controls we recommend, or how we structure IR playbooks.
Engagements like Attack Surface Assessment, Adversarial Testing, and M365 Hardening use lab-derived checklists, test cases, and abuse paths.
Research-driven patterns feed directly into guides, checklists, and playbooks available in the Resources section for clients and partners.
We turn complex research topics into briefings that leadership, security teams, and engineers can act on without needing to become specialists themselves.