I'm Thibault, a trained engineer turned Product Manager with expertise in cybersecurity, as well as a creative most notable for my saxophone work as part of Robocobra Quartet, but I also tinker with acrylic, living art, and code art.
From saxophones to petri dishes and code art
"A storied triumph"
★★★★ · MOJO
"Thank god for Robocobra Quartet"
★★★★ · The Irish Times
"Belfast jazz agitators hit career-best"
★★★★ · The Line of Best Fit
Awarded to Living Isn't Easy.
Fifteen years building security products — the short version.
Runtime application security — ADR, which catches attacks inside live applications. I own the integrations portfolio: getting that attack evidence into the SIEM, SOC and AI tools security teams already use. In the first year I shipped eight SIEM integrations and a universal event forwarder I'd proposed; more recently, the developer experience for the next-generation platform's public APIs. (Senior PM 2025, Principal since 2026.)
Product lead for IBM Security's SaaS transformation across the SIEM and XDR portfolio.
Strategy and lifecycle for the threat-detection portfolio. Drove consolidation onto a single cloud-native platform, and a QRadar SIEM turnaround that lifted commitments on customer feature requests from 77% to 99%.
Originally published on securityintelligence.com, 12 October 2021.
Extended detection and response (XDR) is a security solution that delivers end-to-end visibility, detection, investigation and response across multiple security layers. Core components of an XDR architecture include federation of security signals, higher-level behavioral and cross-correlated analytics, and closed-loop and highly automated responses. This creates a truly unified experience supported by a solutions architecture that equals more than the sum of its parts. Security teams are able to get more value from an XDR that meets the following criteria:
An XDR solution can achieve improved visibility across an organization's networks, endpoints, SIEM and more via open-system integration. Open standards can help move the industry away from expensive and wasteful 'rip and replace' programs. Instead, an open approach helps organizations get more out of their existing investments.
An XDR solution can also offer more automation and AI enrichments at all levels of detection, analytics, investigation and response. Automation throughout the threat life cycle can dramatically reduce mean time to detect (MTTD) and mean time to recovery (MTTR). Not only does reducing these metrics have a direct relationship to mitigating the cost of a data breach, it also frees up time for analysts to do more human-led activities like investigation. An XDR solution also bolsters investigation with a unified view of threat activity, a single search and investigation experience and consistent enrichment with threat intelligence and domain expertise.
For many decades now, emerging threats have put organizations at risk. As the IT landscape evolved and threat actors found new ways to attack, security teams needed to find new ways to detect and respond to threats.
Today, this evolving theme of complexity continues. And the list of point solutions being deployed to overcome these burgeoning threats goes on and on — from SIEM, to cloud workload protection, to endpoint detection and response (EDR), to network detection and response (NDR) and more. While these investments each do their part to solve immediate and dire issues, in combination they've created a bigger challenge: how to use and get value from them together.
This is why we call them point tools; they were made to address specific challenges. Now that security teams face a myriad of challenges, it's never been more critical to have them work in concert. Without doing so, limited security operations resources will continue to be spread thin, total cost of ownership will continue to increase, and pinpointing and responding to threats will continue to be time-consuming and inefficient.
Extended detection and response is the beginning of a shift towards uniting multiple siloed solutions and reducing the complexity that impedes fast detection and response. Gartner identified XDR as the number-one security and risk trend at the end of 2020, suggesting now is the moment when all this complexity — too many tools, too many alerts, too little time — is coming to a head, with XDR as a response.
Industry analysts have outlined two approaches: native and hybrid. Native XDR is a suite that integrates with a vendor's own solutions to collect telemetry and execute response actions. Hybrid or open XDR is a platform that integrates with various vendors and third parties to do the same.
Vendors have been taking different approaches to what is under the hood of XDR. Does XDR = EDR plus additional capabilities? Or EDR plus NDR, or some other combination? It may be too soon to tell where the market lands as the technology is nascent, but the delineation between native and hybrid XDR is one thing the industry seems to agree on.
For some readers, SIEM may have immediately come to mind. There are key differences. In XDR, correlation and alerting tend to be fully automated, employing use cases provided and tuned by the vendor, and incident response focuses on highly repeatable actions that can be automated — sending a suspicious file to a sandbox, enriching an alert with threat intelligence, blocking an email sender tied to phishing. This differs from SOAR, which can be broadly customized with playbooks and used to unite people as well as technology.
XDR can extend the detection and response capabilities enabled today by SIEM. In fact, SIEM can play an integral role in an XDR architecture, gathering, organizing and assessing massive amounts of data for SOC analysts; XDR builds on the data and events flowing through it. When you receive analytics from a SIEM, endpoints and networks separately, it can be like having three different witnesses to an attack — XDR brings all three together into one complete story.
Even as XDR vendors strive to untangle the complexity problem, it will take time. Compounding the challenge is the skills shortage: the need for talent to run analysis and investigations leads many organizations to use a partner for managed detection and response (MDR) services.
MDR is an approach to managing sophisticated detection and response tools — via endpoint, network or SIEM technology — often with proactive threat hunting and 24/7 SOC coverage. As one analyst put it, "XDR success still seems to be based on human expertise," making MDR an invaluable companion to XDR for customers who could use a helping hand.
Zero trust is a framework that starts with an assumption of compromise, then continuously validates the conditions for connection between users, data and resources to determine authorization and need. XDR provides an essential function to zero trust by continuously monitoring for incidents and responding in the most targeted way possible to avoid disruption to the business.
Instead of placing blind trust in a system and saying the controls are enough, with XDR you constantly monitor the places where things could go wrong — which is exactly why identity tools such as identity and access management (IAM) play a critical role tying into XDR architectures.
Your XDR should be an open, extensible solution that lets your organization get more from its existing investments. Look for third-party integrations that spare you a costly rip-and-replace, and cloud-native solutions for cloud visibility. XDR goes far beyond an improved EDR; it should be the end game for threat detection and response, as part of a unified platform.
Ultimately, XDR makes it easier for the people managing and responding to threats every day to do the work. Advanced analytics, constantly updated threat intelligence and a streamlined experience free analysts to spend their time on investigations, not gathering data. People and culture are the keys to the SOC, and by uniting threat-detection data and tools, XDR enables the collaboration and openness that helps teams thrive.
Offering Manager, Threat Detection & Response — IBM Security
Roadmap for QRadar SIEM and Vulnerability Manager. Ran the withdrawal of QRadar's vulnerability-assessment capability — ~600 customers migrated to Tenable and Qualys with zero escalations — and kicked off an OT / industrial-IoT security strategy.
Originally published on securityintelligence.com, 1 July 2020.
When we think about the most public cyber attacks and data breaches, we generally associate them with large enterprises. The truth is cyber attacks are not limited by company size. A significant cyber attack can happen to any company, in any industry and of any size.
According to the 2019 Cost of a Data Breach report by the Ponemon Institute, "small businesses face disproportionately larger costs relative to larger organizations when it comes to breaches."
Typically, one of the most valuable assets for any sized company is its data, and data theft or destruction is probably the most frequent result of cyber attacks on small and medium businesses (SMB). SMBs can be very profitable targets for bad actors, because they have fewer resources and little in-house expertise to plan, implement and execute a cybersecurity incident response plan. Business drivers and modernization needs make it an even trickier balancing act with the norm of working from home.
So how can SMBs protect themselves against costly cyber attacks? The short answer is by selecting a security information and event management (SIEM) platform that will detect threats before they can wreak havoc. However, not all SIEMs are built to address the unique needs of SMBs, which are particularly vulnerable to the following use cases.
Phishing is a concern for security teams across the world, and smaller organizations are as likely to be targeted as larger corporations. Look for a SIEM platform with built-in phishing detection and remediation, so SMBs know employees are protected on this vital communications channel.
Insider threats are another key use case, particularly with the shift to remote work. Privileged accounts, contractors and employees are everyday vectors for attackers, often via compromised credentials. When monitoring for malicious or accidental insider threats, user behavior analytics (UBA) is key to understanding the risks associated with the activity of various users in an organization.
Ransomware is a low-risk, low-cost, high-profitability option for attackers, so it is no surprise it's so prevalent. It is the number-one most likely threat to cause a 24-hour outage at SMBs. Out-of-the-box ransomware detection is a must, protecting an organization from paying a ransom and from the costly loss of availability.
One of the toughest challenges security teams face is the cybersecurity skills shortage. Organizations can take advantage of the cognitive capabilities of AI to enhance the knowledge available to their professionals — gathering and enriching context through analysis of structured and unstructured data, and reducing investigation time from hours to minutes. By separating the wheat from the chaff, analysts spend less time on low-priority incidents and more time preventing breaches or reducing their impact through timely response.
SMBs don't need to be alone in their fight against cybercrime; for many, the answer is a managed security services provider (MSSP) with a dedicated focus on threat detection, investigation and response. An MSSP can efficiently implement the capabilities above and mature use cases across its whole customer base while customizing as required.
Leveraging modern frameworks such as MITRE ATT&CK, SMBs and their MSSP partners can assess, implement and grow their security posture using a common language for threat actors, tactics and techniques — and benefit from threat-intelligence feeds, automation and AI tools that would be tough to deploy with limited resources. By partnering with the right MSSP, SMBs can safely focus on developing and transforming their businesses.
Offering Manager, Threat Detection & Response — IBM Security
Engineering lead and product owner for the QRadar Vulnerability Manager team (eight engineers).
The QRadar platform. Built the first QRadar App SDK and the publishing path third-party developers still use — now well past half a million downloads.
For the QRadar App Framework and SDK.
Second engineer (fourth employee) at a fintech spin-off out of an iOS incubator, later acquired. Built the first server infrastructure and the CI pipeline.
A general-then-specialised engineering degree in France, with an Erasmus semester at Queen's University Belfast (2011–12), and I've been based in Belfast since.
Thank God for Robocobra Quartet. If they didn’t exist, Irish jazz would have to invent them. Every scene needs its outer limits defined and explored, and for the past decade, drummer Chris Ryan’s ever-shifting Belfast collective have been gamely manning the frontier where jazz and improv meet post-punk, art rock and revolutionary politics.
Their 2016 debut, Music for all Occasions, was a liberating blast of drums, bass and horns (guitars are not allowed in the Robocobra universe) that refracted Mingus and Zappa through a Black Flag prism, and the follow-up, 2018′s Plays Hard to Get, expanded their palette further in the studio.
Now their third, Living Isn’t Easy, is a proper concept album, a suite of connected sound pictures about the anxieties of modern living that weave Ryan’s spoken-word narrations through layers of groove and horns and spacey synths. Wellness, the album’s second track, was released as a single in April and, while it didn’t exactly trouble the upper reaches of the pop charts, it’s verbatim reading of facile health tips from a magazine article becomes an arch satire on the modern cult of self-actualisation.
Beneath the situationist critique, there’s grooves and horns and solos, particularly on the album’s centrepiece, Chromo Sud, that may have Robocobra accused of being, you know, a jazz band, but Living Isn’t Easy probably stands up best as a critique of late capitalism. And God knows we need some of that.
Sometimes things aren’t always as they appear – and this certainly rings true for Belfast’s Robocobra Quartet. Ostensibly a band-cum-art collective, adopting a name seemingly steeped in bohemian irony, they peddle more material for the quotidian post-punk scene so fertile in the grassroots of Northern Ireland’s capital. More latently, however, the group of ex-students of Belfast’s Sonic Arts Research Centre have been curating something altogether more holistic. 2016’s Music for All Occasions, and more recently Plays Hard to Get in 2018, saw the band germinate a signature sound of jazz-motivated, punk-informed, avant-garde spoken word that amassed expansive parallels ranging from Fugazi to Black Country, New Road.
2022’s Living Isn’t Easy follows a four-year fallow period, but firmly promises to build on the wide-ranging and well placed foundations of previous works. Vocalist, producer (Just Mustard, NewDad, Junk Drawer), drummer and de-facto spearhead Chris W. Ryan shines most prominently on lead single, ‘Wellness’. Here, his acerbic assessments of influencer health and wellbeing culture are cut out with sarcastic metrical readings of unfortunately very real ‘wellness’ articles, which sound not unlike James Murphy’s second self on LCD Soundsystem’s ‘Losing My Edge’ growing further into neurotic hypochondria.
More of the same can be found elsewhere as poetic deliveries nestle aside imposing production and almost referentially encyclopaedic musicianship. These tracks tell a story loosely based around a central character, exploring themes of absurdity and mundanity of modern life, whilst also delving into deeper themes of abuse. Delivering the backbone here are lashing basslines straight out of the D.C. post-hardcore playbook (see ’Flew Close’ and ‘Heaven’), deft drum patterns that would sound at home on any of Charles Mingus’ works (‘Flew Close’), are all housed together with galvanising saxophone and synth sections (‘Plant’ and ‘Chromo Sud’).
Here, Robocobra Quartet seemingly operate in perfect balance: musically and lyrically serious, yet also comedic in their experimentation and droll in their delivery. As the recent crest of Irish post-punk bands rummage for a new sound, it seems as though this particular one has struck gold.
I was first introduced to Belfast’s Robocobra Quartet as an astonishing live spectacle. Plays Hard To Get is the closest the band have come to capturing their jaw-dropping live presence on record.
The movement of the songs is practically symphonic, and each burst of brass or plaintive moment of woodwork feels immaculate. Chris Ryan’s lyrics – closer to the American beat poets of the 1950s than most contemporary rock and pop – are fascinating in their denseness. Moments of lightness steer the record away from the self-indulgence it occasionally threatens; I Shouldn’t Have Watched The Film What Lies Beneath (When I Was Twelve) has a ludicrous, knowing sense of melodrama about it.
The album takes disparate influences and assimilates them into something interesting, direct and emotional.
Robocobra Quartet exist in liminal space. A perpetually in flux blend of Touch & Go/Dischord-era post-hardcore sits alongside minimal contemporary classical & jazz, very little about what they do should work, and beyond the product of Nineties Louisville weirdness, Rachel’s, there’s little precedent for it. The wrong hands would ham-fist it together into an incongruent mess, riddled with either cliché or impenetrable, directionless meandering. Formed in the small avant-garde hub of Belfast’s Sonic Arts Research Centre, they’re certainly not naïve enough to be considered outsider, nor does some overarching visual conceit play enough of a role to be considered art rock. Die-hard punks would reject them for their composition, while the precedence of spoken word vocals and their adherence to pop convention keeps them out of all but the most liberal jazz club.
There’s a moment 40 seconds into Plays Hard To Get, as an ornate Hollywood string section unfurls, where it becomes evident that the Robocobra Quartet heard on this album has underwent substantial evolution since their 2016 debut. “Following loose threads, we spend our teens brushing the dust off brick to uncover some hidden hieroglyphic”, Chris Ryan enunciates, in the first of many punctuation marks in a lengthy dialogue between himself in the present moment, past self, inner monologue and contemporary culture. At the 52-second mark, the pulsing stomp of ‘Short Stretch of Day’ broadens the panorama into the theme for an all-encompassing Adam Curtis-directed blockbuster rumination on humanity. 'I was just trying to write a pop song', Ryan has said of it – true, in a sweeping, orchestral Talk Talk sense.
Plays Hard To Get necessitates active listening - few ears will react with passivity to a frontman whose over-enunciated search for truth is as influenced by the curated spontaneity of Stewart Lee’s cadence as it is the Dismemberment Plan’s Travis Morrison. Just as an infatuation with the mind of Mark E. Smith is to appreciating The Fall, so too is drummer, vocalist, and primary composer Chris Ryan’s worldview to Robocobra Quartet. An internal anxiety-symptom checklist, its wandering existential extrapolations often opt to twist the knife rather than indulge in romantic, poetic inclinations that usually accompanies the same feeling on, say, a Nick Cave record.
Despite that, it’s kept afloat by enough musical buoyancy to offer respite, as we’re dragged by Ryan on some Quantum Leap arc across zeitgeist snapshots, characters and ciphers (“crack that goal for 1860 Munich”, “Hands on rails/In a regional hospital somewhere”), that incrementally fill in our view of the bigger picture here. A panache for these evocative cultural touchstones and what Chris Morris would call ‘magic words’ disarm, before we’re floored with broad truths (“We’ll find a better use for that unused noose”, “I’m three times the person I used to be, but twice as unsure”).
‘You’ll Wade’ and ‘Try Hard’ work as spiritual heirs to to the previous album’s ‘You’ll Shrug’ and ‘Nice Life’, their comment on the unbearable weight of emotional and artistic baggage, the pitfalls of over-reliance, and self-prescribed debts to others, as experienced by today’s adult children - “Hell hath no fury like a scorned hopeful” indeed. As with many of the album’s rock-oriented moments, they’re underpinned via the Fugazian technique of employing bass as hook-laden rhythm guitar, loosely but measuredly introducing flourishes of modern classical instrumentation.
Everything on here is transtextual, but for what purpose beyond some indulgent self-constructed artistry? Robocobra Quartet explore the extent to which life can be mined for painstaking, autobiographical art. Both can be a fucking slog, but for those moments of complete, escapist wonder and a fleeting sense of understanding. Whether they arrive with little prescience or crushing inevitability, some uncomfortable truths signposting the way, Robocobra manage it in their measuredly spontaneous moments of humanity.
Sometimes those moments arrive in the concession of just one vocal line to melody, or in a moment of outright doom when the clickbait-satisfying bar of ‘Bar 37 Will Shock You!’ arrives, and along with it the cold sweat of that moment of sheer dread upon the crushing realisation that the yearning you feel for those salad days won’t ever be satisfied. Where the band often deliver maxim upon maxim of self-reflection and flagellation, Ryan’s ongoing fascination with pop culture idiom (“It’s been a while since liquid on airlines”) offer another reading that ultimately prods at a broader collective mindset, and it’s here where the heart of Robocobra Quartet’s craft lies.
It’s weighty, but in turning its gaze outward and recognition of the power of silence and breathing space for its ensemble, Plays Hard To Get feels leaner and more cohesive than its predecessor, despite a substantially longer runtime. An album that expertly plays on expectation, playing the dynamic long-game and intentionally weaves knots into its tapestraic narrative, Plays Hard To Get is the most daring, fully realised LP to emerge from Ireland this year, and it’s hard to imagine it being topped.
With fourteen interchangeable members Robocobra Quartet breach convention not simply in the nominal sense. Since forming in Belfast’s Sonic Arts Research Centre back in 2014, their cunning marriage of jazz, spoken word, punk and avant-garde noise has thrown the cat amongst sleepier circles at home, setting them apart as an act intent on mining meaning from hard-won scope and purview. Led by drummer, vocalist and de facto frontman Chris Ryan, their debut album, Music For All Occasions, is a carefully-crafted release that presents one’s thinly-veiled personal disquiet as a single prism beam bounding from the much bigger picture.
Almost symphonic in its poise and flow, Music For All Occasions is a record where even small details are rendered with precision – almost nothing, it seems, is kneejerk; the tangents feel intended. With slick sax and iterative webs of bass and drums wedding to form a strong core throughout, Ryan’s words offer up a narrative that blurs musing doubt, flickers of dead conversation and the dregs of self-conscious recall in masterful fashion. Take opener and lead single ‘Correct’, a track touching on the irreducible triviality of personal endeavor or ‘You’ll Shrug’, an early highlight bowing out in an impressionistic cloud of Mingusesque noise: in much the same way Julia Holter re-frames Woolf’s “incessant shower of innumerable atoms” Ryan’s self-referential scattergraph takes the choking insignificance of even the most throwaway encounter and – just as Enablers’ Pete Simonelli fixates over the madness of nameless characters of the night – sets it all free through song.
Musically, it’s controlled experimentation and intuitive economy that underpins the orchestrated praxis: from flurrying jolts of brass that run the gamut from wispy to rapt and bobbing rhythms that unfurl beyond the realm of second-guessing to metrical bass lines that rarely take the easy way out, these nine compositions triumph as a whole by resisting the descent into a blustering miasma of sound each time. From two-minute anti-mantra ‘Find X’ (“find yourself saying the same thing…”) to ‘Nice Life’, a peak about not being able to get out of bed in the morning (“Chris won’t be seeing anyone today, he feels it’s better this way”) Ryan commands more by way of hinting ciphers than outright obscurism, centered above a sound that only imposes itself when due. Composure here is tantamount to cutting loose.
But it’s closer ‘Album of the Year’ that sees the modus operandi of the self-released Music For All Occasions as a record – rather than Robocobra Quartet as a live proposition – hit home. Much like Donny McCaslin Quartet’s work on the more downcast moments on Bowie’s Blackstar, its subdued meditation on “that” feeling of disassociation at the tail-end of the year is imbued with a taut musicality – quivering clarinet, chromatic bass inversions, extended piano chords – that knows the inherent value in quietude and pace.
With Ryan audibly crying on the track, the unbearable shiteness of being is laid bare: where the severity of the unsaid thing holds its own elsewhere, a hard dose of the realest of real shit does wonders here.
Whilst it feels much more like a checkpoint rather than a breathless culmination of the band’s burgeoning trajectory over the last three years, the ambition of Music For All Occasions is concurrently – and fully – realised in its vision and restraint. A record that neither overstays its welcome nor veers into wandering overdulgence, it stands up as the Irish album of 2016, at the very least. Here’s to more.