Papers, data and student research from WitFoo
WitFoo publishes the thinking behind its products, data that others can test their own work against, and research by students who work on its problems and its data.
Papers
The AI cost collision in cybersecurity
WitFoo, October 2026.
Why empathetic processing becomes the economic imperative of the next decade.
Empathetic Processing in Cybersecurity: A Human-Centric Data Analytics Paradigm
Charles D. Herring, November 2025.
The case for processing security data the way a skilled analyst listens: understand each event in context, reconcile conflicting accounts over time, and report in terms each audience can act on.
Data
The Precinct 6 Cybersecurity Dataset
More than 114 million sanitized security events captured live from five organizations in 2024, with incident provenance graphs, released under Apache 2.0. The corpus was produced in collaboration with the University of Canterbury (UC) | Te Whare Wānanga o Waitaha Computer Science and Software Engineering department.
Student research
Research by final-year students in UC’s Department of Computer Science and Software Engineering, either sponsored by WitFoo or built on its open data, published with each student’s permission.
Distributing graph analytics across machines with DxHash
Research by Dylan Costello, 2026.
A consistent-hashing design that let five machines store the same artifacts as a single-node model, using 54% of its memory, tested on a model network WitFoo provided.
Testing provenance-graph intrusion detection on real data
Research by Ben Irvine, 2026.
Four published intrusion detection systems tested on a real SOC day from the Precinct 6 Cybersecurity Dataset: none offered a usable operating point as configured, and threshold rules mattered more than models.