Founder and President, DePalma Research LLC
Digital Forensics and Incident Response for AI Systems • Detection Engineering • Threat Intelligence • Applied AI for Security

14 years across incident response, threat hunting, intrusion analysis, and detection engineering: from a DoD Top Secret clearance at MIT Lincoln Laboratory to leading critical breach and zero-day investigations as Principal DFIR Technical Architect at Unit 42 (Palo Alto Networks). In October 2026 I started DePalma Research to work on one question most organizations have not planned for: what do you do when the victim is an AI system?

When the victim is a model, an agent, or a pipeline, some of the evidence is on the host and the rest is somewhere investigators were never trained to look: prompt histories, tool calls, embedding stores, agent state, and inference logs that age out in hours. The habits of good DFIR still hold. The artifacts, the acquisition, and the questions are new.

• Languages & Frameworks: Python, XQL, SQL, Google ADK, LangChain/LangGraph
• Detection & Analytics: Sigma, YARA, Suricata, SIEM/XDR query languages, Cortex XDR and XSIAM telemetry
• AI & LLM Security: MCP (Model Context Protocol), OWASP LLM Top 10, MITRE ATLAS, agent and RAG pipeline forensics

• AI System Forensics: Investigative methods for compromised models, agents, and pipelines, from evidence sources and acquisition to timeline reconstruction and the story you tell leadership afterward.
• Defending AI Infrastructure: Production-grade detection rulesets for LLM applications, MCP servers, model supply chains, and RAG and vector database attacks.
• Threat Intel Automation: Data pipelines and autonomous agents that accelerate collection, enrichment, and triage, built on fourteen years of tracking nation-state and criminal infrastructure (APT, ransomware and RaaS, DPRK insider operations, zero-day exploitation).
• Training and Briefings: Hands-on practitioner training on working this new kind of crime scene, and plain-language executive briefings on AI incident exposure and readiness.

• 🌟 ai_for_the_win - An open-source training program with 50+ hands-on labs and CTF challenges covering ML, LLMs, RAG, threat detection, DFIR, and red teaming. Colab notebooks, a Docker environment, and a companion site.
• 🧰 ai-dfir-toolkit - A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG and vector database attacks. Apache 2.0.
• 🤖 AI-Powered-Ransomware-Intelligence-Agent - An automated n8n and Claude pipeline that ingests leak-site data and converts it into structured, MITRE ATT&CK-mapped threat intelligence. Companion to the SANS ransomware intelligence webinar.

• SANS DFIR Summit 2026, Arlington, VA | Opening Keynote, October 16, 2026
  • "The AI System Was the Victim: Forensics for a Crime Scene with No Disk Image"
• SANS "Stay Ahead of Ransomware" Series | Featured Speaker alongside Ryan Chapman and Mari DeGrazia
  • "The AI Arms Race: When Both Sides Have Copilots"
  • "Building an AI-Powered Ransomware Intelligence Agent"

• LinkedIn
• DePalma Research LLC on LinkedIn
• Message me to compare notes on AI incident readiness, investigating compromised AI systems, automating DFIR workflows, or adversary infrastructure analysis.