Systems Distilled
systemsdistilled.com
Ideas, research, and work by James Shank.
I study how technical systems, organizations, and markets shape the decisions people make. My work starts with the structure of a problem: who can act, what they can see, which incentives move them, and where control sits. I use what I find to build systems and methods that people can put to work.
Most of my published work is in security, threat intelligence, and AI. I bring the same approach to the projects I run and the companies I build.
Questions I am working on
- How should security teams decide which work reduces harm? See my FIRST CTI 2026 talk with Brian Hein.
- Where does responsibility sit when AI acts across people, systems, data, and vendors? See the AI Security Risk Framework.
- How do incentives, trust, and economics shape what organizations can achieve together? See the Cyber Risk Working Group.
Now
My latest talk is Red Teams and Real Attacks: Misalignment due to Skewed Incentives, which I gave at CanSecWest 2026 in Vancouver on 30 September 2026. It draws on research I did with Ben Nahorney.
Featured work
-
Framework · 24 September 2026
A guide to thinking about AI security risk
Expel · Author · ↗ expel.com
AI changes how data is handled and how authority passes between systems, and those changes touch several teams at once. The framework's ten risk domains and six control planes help leaders decide where each piece of work belongs and connect it to business impact.
-
Talk · 23 April 2026
How NOT to be Your Adversary's Best Friend - Doing What Matters...
FIRST CTI 2026, Munich · Speaker, with Brian Hein · ↗ first.org
Threat intelligence is often praised for being actionable, yet action alone does not stop adversaries from profiting. Brian Hein and I asked how intelligence work can hurt them.
-
Publication · 27 January 2021
Team Cymru · Author · ↗ team-cymru.com
Network operators blocked the Emotet servers that law enforcement could not seize in January 2021, so infected computers would connect to the seized ones. Team Cymru built the block list with Cryptolaemus, and nearly every invited network took part.
-
Research · 8 March 2022
Record breaking DDoS Potential Discovered: CVE-2022-26143
Team Cymru · Co-author · ↗ team-cymru.com
About 2,600 exposed Mitel phone gateways let one spoofed packet start a DDoS attack lasting up to 14 hours, with an amplification ratio above four billion to one. Researchers, network operators, and vendors, Mitel among them, formed a task force to study the attacks and publish mitigations.
-
Publication · 17 June 2025
Operation Endgame: Do Takedowns & Arrests Matter?
Dark Reading · Author · ↗ darkreading.com
Using the Emotet and Trickbot takedowns as evidence, I argue that efforts such as Operation Endgame shift costs onto criminals and slow their attacks for a time. That is why defenders need to keep coordinating them.
-
Framework · April 2021
Combating Ransomware: A Comprehensive Framework for Action
Institute for Security and Technology, Ransomware Task Force · Volunteer member · ↗ securityandtechnology.org
Helped write the 2021 Ransomware Task Force framework that shaped US ransomware policy. I chaired its subcommittee on worst-case scenarios.
Projects
-
Project · 2024 to 2025
Facilitator · Closed
-
Project · 2021 to now
Chairperson of the Board · ↗ internetfire.org
-
Framework · 24 September 2026
Expel · Author · ↗ expel.com
-
Project · 2026
Project manager · Funded by Acutis Ventures · By Dragos Ruiu and Jeff Nathan · ↗ wgtcp.net · ↗ GitHub