David Porco

DFIR Addict - Tilting at Security Windmills. @Blueteamvillage Director. I do not speak for my employer, their clients, or customers

[David Porco @OMENScan]

@HackingDave Please swing by @BlueTeamVillage @defcon and say hi.

[Phill Moore @phillmoore]

Week 22 - 2026 #DFIR
https://t.co/UJ8yz1wgKK

[David Porco @OMENScan]

I have spent the last few months developing analysis software that is unreal using the best AI models available.

But also trying to build local inference versions to do similar things on standard hardware - which has largely been a dismal failures.

The divide is massive.

[David Porco @OMENScan]

@HackingDave Something amazing is happening

I am NOT a developer. I code to solve problems. Over 35+ years I've coded in a dozen languages.

Now I am writing/documenting/testing new software in days vs weeks that solve real problems.

And never writing a line of code.

That's the difference

[David Porco @OMENScan]

It's interesting to see things go from:

That's a stupid idea that will never work

OK... It can work but it has flaws and limitations

OK... It works pretty good for some things

Wow... Lots of people are now doing it that way

Most people do it that way now

[David Porco @OMENScan]

@HackingDave Time.

It's a grand new journey - for him, and for you. Enjoy it.

[David Porco @OMENScan]

@shenetworks - Pick a hard problem that interests you
- Automation is popular
- Python & Go are fine: popular, x-plat & capable w/good libraries
- Be creative
- Learn Git & IDE
- Learn Cloud
- Don't let naysayers dissuade you
- Use AI
- Most languages do the same things, just different syntax

[marqix ☆ @fwmarqix]

Me: sitting quietly in a tiny ramen shop.

Chef: Extra egg?

Me: Sure.

Chef nods with terrifying seriousness.

Friend: Congratulations.

Me: For what.

Friend: You've been chosen.

Me: By WHO.

Chef disappears into kitchen.

Entire staff suddenly start moving faster.

Me: Why did the atmosphere change.

Friend: You complimented the broth too sincerely.

Me: That's bad?

Friend: Now he must prove himself.

Me: This feels illegal.

Chef returns carrying a bowl that looks spiritually important.

Chef: Please.

Me: Why does this ramen have an aura.

Friend already taking photos: I've never seen him use that spoon before.

Me: WHAT SPOON?!

Old customer in corner whispers: "The dragon ladle..."

Me: absolutely not.

Chef watches silently while I take first bite.

long pause

Me: ...oh my God.

Chef closes eyes slowly like a warrior hearing good news from battle.

Random businessman starts clapping once.

Then the whole restaurant joins in.

Me: PLEASE STOP.

Friend wiping tears: He accepted you.

Me: IT'S NOODLES.

[David Porco @OMENScan]

@anton_chuvakin I think the more interesting question would be: If you had the ability to create your own agentic SOC software the way you wanted, would you feed your playbooks and the last year of your ticket data into it to tune and validate the system?

[David Porco @OMENScan]

I’m increasingly convinced that AI-assisted coding amplifies expertise more than it replaces it.

The success or failure of the project is often proportional to the developer’s experience in the domain.

My most common prompt:
“STOP. Don’t do it that way. Do it this way instead.”

[David Porco @OMENScan]

I always recommend that new infosec leaders inventory their existing tools and ask: What can we do with these tools that we are not doing?

AI is making that much easier, faster, and a whole lot more fun.

The future is using AI to glue tools together to unlock incredible value.

[David Porco @OMENScan]

@HackingDave For me, this has occasionally happened. It's bizarre that everything can be so spectacular, then randomly horrible with swaths of code deletes.

I have had to ask AI to go back and fix its actions multiple times and then it returns to great.

It's definitely part of my workflow

[David Porco @OMENScan]

This

[Dave Kennedy @HackingDave]

What I see in cybersecurity:

AI has re-invigorated an industry that was largely stale for the past ten years.

Complete new green field. Changes everything. New innovation happening everyday.

Need to adapt or be left behind.

This reminds me of the early 2000s, it’s exciting, addicting, and it’s going to be fun as hell.

[David Porco @OMENScan]

My fairy godmother John, made my dream come true at the Porco Tiki Lounge in Cleveland.

Only about 6 people on the planet will get that.

I'm OK with that.

[David Porco @OMENScan]

Woke up this morning, poured a cup of coffee and vibe-coded a brand new triage collector that uses EDR APIs to collect at scale. No reference code, just an idea, an IDE and AI.

Finished it before I finished my coffee.

It works. Really good.

This is insane.

[David Porco @OMENScan]

Thinking today: Besides the unreal pace of development, what else makes AI different from the disruptive tech of the past?

Then I realized. This is really the first time that a USER with some tech savvy can create their own customized tooling in a few weeks

That's incredible.

[David Porco @OMENScan]

I've been coding for over 35 years. Everything from Assembler, Perl, and C to JS, Python, and Go.

Last few months I've moved to directing AI to code for me, which I check and improve through iterative instructions.

I can still write code, docs, and test cases - but why would I

[David Porco @OMENScan]

@inversecos @TheGeorgePu I'm honestly not sure how many companies are doing this. But I know some that are. And in the right environment it is quite effective.

[David Porco @OMENScan]

Using AI is no different than using any automated system.

All automated systems have blind spots, outliers, false positives, and false negatives.

People that use AI effectively know that, and make it part of their thought process.

[David Porco @OMENScan]

PSA: AI doesn't always know all the facts - especially outliers that can fundamentally change its conclusions.

AI use should be collaborative & a healthy dose of skepticism should be part of the process

Pointing the AI to official documentation can help it understand its errors