Resources
New releases from the Nodal team land here first: case studies, white papers, interactive explainers, videos and writing. Filter by type, or search.
- Case studyHow a four-hop campaign was cut in a resort network17 pages · 18 min readThe engagement in full: what was found, how far it had already spread, and what the disruption actually did.
- White paperA supply-chain intrusion inside a law firm, caught by behaviour18 pages · 22 min readA SolarWinds-shaped compromise reaches a 180-seat legal practice through a managed update. No malware, no exploit, and eleven days before anything looked wrong. This is how the campaign was reconstructed and stopped.
- WalkthroughWatch a campaign get caughtInteractiveOne intrusion, traced from a stolen credential to a severed command-and-control channel. Every technique real, none of it malware, and the reason a conventional stack stays quiet throughout.
- VideoVideo libraryVideosWatch Nodal CyberBrain detect a coordinated campaign, trace it to its command-and-control, and cut the channel, plus short briefings on the threat landscape behind it.
- EvidenceEvidence and validationCase, quote, advisorsOne load-bearing case study, the customer quote we're cleared to publish, and the people who have staked their reputations on the platform.
BlogThe intrusion that never fired an alert18 August 2026 · 3 min readEvery tool worked exactly as designed. The campaign still ran for four months. The problem is not detection quality — it is that nothing in the stack was built to assemble a story across machines.- BlogYour EDR is not the problem29 July 2026 · 3 min readEndpoint platforms are authoritative about what happened on a machine, and they are being asked a question they were never designed to answer.
- BlogThe hop that cannot run an agent24 June 2026 · 2 min readPrinters, controllers, imaging systems and legacy appliances carry real traffic and take no security software. In most environments they are the middle of the attack chain and the blindest spot in the record.
See it work
When you're ready to see campaign detection live.
Thirty minutes with a Nodal engineer: a real campaign detected, traced to its command-and-control and cut, on your questions rather than a script.