Johannes Stillig

I'm Johannes. I have spent eighteen years on the response side of security, and I build the machinery that turns a breach dump into a number you can defend. A public research corpus of 49,547 emails contains 710 people. 49,547 emails in 249,...

I'm Johannes. I have spent eighteen years on the response side of security, and I now build the machinery that turns raw evidence into answers. This post is about the rawest evidence there is. In June 2024, LockBit announced it had breached the United Sta

I'm Johannes. I build an investigations engine where every finding has to trace back to the source bytes it came from, which turned out to be an awkward promise once a language model started helping produce the findings. In a trust accounting case in New

I'm Johannes. I have spent eighteen years on the response side of security, and the thing I keep returning to is that a control is only worth what you can prove about it afterwards. In roughly one breach in five, the first person to tell the world what ha

I'm Johannes. I build systems that run on their own without going off the rails: a security product during the day, and this at night. If there's a thread through everything I make, it's that autonomy should be earned structurally, not hoped for. Right no

I'm Johannes. I'm building Tidebreak, an investigations engine where every finding traces back to the source bytes it came from. That obsession with provenance is also why I can only write about my own engineering one way: with the parts I got wrong left

This is the first post. If you are reading it, the pipeline works. What this proves The build renders Markdown, highlights code at build time, generates a tag archive, and puts the result behind a CDN with a content policy strict enough to block its own s