About

I’m James Duncan, a cyber security practitioner with a background spanning ICT, cyber security, offensive security, and security engineering.

My main areas of interest are Active Directory and Windows security, detection engineering, penetration testing, application control, and understanding how real-world attacks can be detected and mitigated.

A lot of my work involves building, breaking, and analysing systems to better understand how security controls behave in practice. I particularly enjoy the point where offensive and defensive security meet: understanding how an attack works, identifying the telemetry it produces, and turning that knowledge into practical detection and mitigation advice.

What I write about

This site is where I document things I’ve learned through research, lab work, development, and practical experience.

Topics will generally include:

• Active Directory and Windows security
• Detection engineering and security monitoring
• Offensive security techniques
• Application control
• Cyber security architecture and hardening
• Security tooling and development
• Australian cyber security guidance and the Information Security Manual
• Lessons learned from building and operating security labs

My aim is to focus on practical technical content, particularly where I’ve tested something, encountered an unexpected result, or think there is value in explaining the reasoning behind a security control rather than simply repeating established guidance.

Background

My professional experience includes penetration testing, purple team activities, Active Directory security, Windows security, security architecture, detection engineering, and assessing security controls in complex enterprise environments.

I hold a number of industry certifications including OSCP, CISSP, CCSP, CISM, CISA, CRISC, GPEN and GDSA.

Projects

I enjoy building tools and security labs to explore techniques in more depth.

Some of my projects are available on GitHub.

You can find current and future projects on the Projects page.

Why this site exists

I created this site primarily as a place to publish longer-form technical material that doesn’t fit particularly well into a social media post.

Elsewhere

You can also find me on:

• GitHub
• LinkedIn

The views expressed on this site are my own and do not necessarily represent the views of my employer or any organisation with which I am associated.