Practitioners who sharpen the field

Dormann worked at CERT/CC from 2004 and focused on browser technologies, ActiveX, fuzzing, and software behaviors that create security exposure. His public analysis is useful because it often distinguishes a theoretical flaw from the specific configurations and user actions required for exploitation. Follow his work for reproducible testing ideas and pragmatic risk context.

Roth’s work connects threat research with detection content that security teams can operationalize. His projects include Sigma and multiple tools for compromise assessment and indicator-based scanning. Follow him for new detection rules, coverage discussions, incident-response observations, and practical ways to turn research into hunts.

Rothman is not primarily a security researcher; her value for defenders is in the operating system around technical work. She explores how leaders structure teams, expose risk, manage portfolios, forecast work, and create conditions for better decisions. Her writing is especially useful for security leaders trying to communicate uncertainty and improve delivery without adding process for its own sake.

Campbell has advised government and industry on protecting critical national infrastructure and on large technology-led transformation programs. His perspective is useful for connecting technical controls with operational resilience, investment decisions, and the physical consequences of cyber incidents. Follow his work for sector-level thinking on energy, utilities, and infrastructure risk.

Carhart leads and supports digital-forensics and incident-response work in operational technology and industrial environments. Their writing and teaching cover ransomware readiness, investigation under operational constraints, career development, and the differences between enterprise IT and systems that control physical processes. Follow for field-tested response lessons and clear explanations of complex incidents.

Nickels has led intelligence and research teams, previously worked on the MITRE ATT&CK team, and teaches SANS FOR578 Cyber Threat Intelligence. Her work is valuable for analysts learning to scope requirements, communicate confidence, map adversary behavior, and produce intelligence that supports an actual decision. Follow for rigorous tradecraft and accessible analyst education.