What's Jeff up to these days? I'm Building Monadnock Cyber.

What is Monadnock Cyber? Where Data meets Intelligence, meets whatever Jeff thinks might be fun to work on. 

Many of you know me from my work in threat intelligence and cybersecurity. What you may not know is what I've been building lately. I wanted to share some of the projects that have been keeping me busy at Monadnock Cyber.

The Common Thread: Intelligence-Driven Solutions

Throughout my career, I've been fascinated by the intersection of data, security, and actionable intelligence. Whether it's protecting organizations from cyber threats or helping individuals make informed decisions about high-value assets, the core mission remains the same: transforming raw data into meaningful insights.

Here's what I've been working on:

Beadwindow: The End of the Manned SOC

Here's a truth that most MSSPs won't tell you: the traditional 24x7 Security Operations Center model is broken. Not struggling. Not outdated. Broken.

I learned this the hard way. As CEO of an MSSP, nearly a third of my gross margin went to paying for a manned SOC. When we won large contracts, the SOC grew to meet demand. But when we lost those contracts? The costs never shrank back. That's the dirty secret of the SOC business model—it scales up beautifully but once the SOC gets used to having another person on the shift, it gets much harder to scale back.

But the economics are only half the problem. The efficiency math doesn't work either.

The best human analyst—caffeinated, focused, and at peak performance—can handle 50 to 60 cases in a 12-hour shift. My little office runs one small FortiWifi 40FW firewall and a remote home-based Firewalla that I monitor remotely from my office. That modest setup generates 35 alerts per minute. Let that sink in. Two consumer-grade firewalls produce more alerts in one minute than a top analyst can process in half a day.

Scale that to an enterprise environment with neural network-based detection and self-teaching machine learning, and you're looking at 22 (likely more) alerts per second. No human could ever keep up. No team of humans could keep up. The velocity of modern threats has outpaced human capacity entirely.

That experience drove me to build Beadwindow. The days of the manned SOC—both cyber AND physical—are nearly over. Organizations don't need shift schedules. They need intelligent automation that operates at machine speed.

Beadwindow(TM) can prove that.

Gingerbread: Executive Privacy and Protection Intelligence

Privacy and security go hand in hand. But here's what's always frustrated me: you can hire companies to scrub your personal information from the internet, but you never actually see what they're doing.

I work with some great firms who handle takedowns of privacy information across data brokers, people-search sites, and public records. They do good work. But as a client, you're operating blind. Where was your data exposed? How bad was it? Are people going to show up at my house? Is this something that might take down my company? Are my kids' exposures going to get us into trouble? Are people TARGETING my wife and kids?

Gingerbread changes that. It's not just executive privacy—it's Protection Intelligence. An application designed for executives and high-profile individuals who need to protect their digital footprint and know that the actions taken ARE helping keep them safe, in their home and at work. 

Now, I've had people tell me, "If we knock down all the privacy information that's out there, there's no need for firewalls and monitoring and 24x7 SOCs." This is one of the most misinformed (sales focused) comments I've ever heard. Why? botnets account for over half of the activity on the internet today, and they don't care if your PII is out there or not. They just keep coming. Privacy protection reduces your targeted attack surface—the spear phishing, the social engineering, the executive impersonation. But the autonomous threats? They're relentless and indiscriminate.

You need both. Privacy without security is wishful thinking. Security without privacy is a door with your home address taped to it.

REFax™: Property Intelligence Reports

For the last 15 months, I've been dealing with major health issues that have kept me close to highly skilled doctors in Boston. When I was first diagnosed, I decided to sell my second home in Harpers Ferry—one of the largest lots on the Shenandoah River. I've always wanted lakefront property in Maine, so I thought, why not?

I listed with a local real estate agent who promised the house would sell in weeks. Weeks turned into months. Months turned into six months—the full length of his exclusive listing contract. During that time, my little piece of West Virginia heaven was shown exactly five times. Not one offer. Why? He had no idea.

It didn't require AI to figure this one out!): he had overpriced my home by $200,000 and listed the lot size as 0.85 acres instead of 4.5 acres. Dumb ass. No wonder it didn't sell. And then I started thinking: what does it actually take to become a real estate "expert"? Turns out, in New Hampshire, it's a 40-hour course and a test. That's it. Abracadabra!You're an expert!

So I thought.. Let's level the playing field. I took Harvard CS50 to learn python, then AI development through MIT, and I started collecting data. Lots of property data. I ran it through some straightforward AI analysis and generates valuations using about a half dozen models and the output? Any user (home owner, home seller or real estate professional, gets expert intelligence and analysis, all produced quickly, under strict rules, checked and double checked. I've been an analyst of some sort since 1996— military cyber intelligence (they called it information operations at the time), information security and cyber threats—I understand analytic rigor and the rules that govern it. Real estate deserves the same discipline. So that's what I built.

If you buy or sell a car, you get the Carfax. If you buy or sell property, you should get the REFax™—the Real Estate Fax.

It's a Property Intelligence Report system that any homeowner, home seller, or real estate professional can use to get actual answers backed by data. Think of it as threat intelligence for real estate. The same methods I used to assess risk indicators and threat actor TTPs now evaluate properties through multiple lenses—market positioning, comparable analysis, and investment potential. No gut feelings. No guesswork. Just intelligence.

I've since built versions for Residential, Commercial, and Land. The next one in development tracks and advertises defense contractor sales and acquisition opportunities—same analytic rigor, different domain.

The Residential model is the only one online today, and it's proving very popular.

What's Next?

If it's fun, and there's a problem that needs to be solved, I'll drop it into my R&D pipeline.

The tools and techniques we've developed in the threat intelligence community have applications far beyond malware analysis and incident response.

If you're interested in learning more about any of these projects, or if you see opportunities where intelligence-driven AI-assisted solutions could help your organization, I'd love to connect.

Jeff Stutzman, Chief Solutioneer, Monadnock Cyber

Monadnock Cyber Intelligence Assessment: Operation Absolute Resolve

Date: January 3, 2026

Subject: Impact of U.S. Kinetic Actions in Venezuela on Global Energy Infrastructure
Source: Monadnock Cyber Intelligence (Open Source AI-Driven Analysis)

Analytic Confidence: Moderate

---

1. Executive Summary

Monadnock believes that the capture of Nicolás Maduro by U.S. forces has initiated a high-likelihood state-collapse scenario mirroring the Libya 2011 Parallel. The resultant power vacuum in Caracas has effectively decentralized the security of Venezuela's energy infrastructure. We believe that the transition from a centralized autocracy to a contested military vacuum creates a critical risk environment where physical, cyber, and legal threats to Western interests have converged.

---

2. Strategic Risk Profile

Physical Risk: Targeted Personnel and Assets

• High-Value Targets: We assess it is probable that irregular forces, including colectivos and criminal syndicates like Tren de Aragua, will attempt to seize Western oil executives, High Net Worth Individuals (HNWIs), or Politically Exposed Persons (PEPs) for use as political leverage or "human shields."

• Travel and Aviation: There is an almost certain risk of encountering arbitrary checkpoints or kinetic spillover. We judge that non-military aviation faces a high-confidence risk of navigational interference due to active GPS jamming in the Maiquetía Flight Information Region (FIR).

Cyber and Infrastructure Risk: The "Sloppy Recovery" Phase

The overnight kinetic strikes catalyzed the "Sloppy Recovery" of the December 2025 PDVSA ransomware breach, adding a long recovery scenario that will hamper a full restoration of export logistics and administrative systems for months, if not years.

---

The convergence of these two events creates a compounding crisis:

Pre-Strike Conditions (Dec 13-15 breach):

• Antivirus remediation efforts reportedly disrupted the company's entire administrative network, forcing workers to keep handwritten records after systems failed to restart.
• More than 11 million barrels stranded on vessels.
• IT/OT separation preserved production, but export logistics remained severely degraded

Post-Strike Compounding Factors (Jan 3 Operation Absolute Resolve):

• PDVSA's oil production and refining were normal, and its key facilities had suffered no damage, according to an initial assessment CNBC—but this misses the administrative layer still limping from ransomware
• Leadership vacuum and regime change disrupts any coordinated IR effort
• Venezuelan state-owned oil and natural gas company PDVSA says its pipelines haven't been updated in 50 years, and the cost to update the infrastructure to return to peak production levels would cost $58 billion CNN
• Sanctions-induced technology isolation already limited access to Western cybersecurity vendors for proper remediation

The "Sloppy Recovery" of PDVSA from a December 2025 ransomware event has now essentially frozen revovery—and whoever ends up managing PDVSA inherits a ransomware-degraded administrative system with no clear chain of custody for incident response.

• OT/SCADA Exposure: We judge it is highly likely that local Operational Technology (OT) systems are being operated without central oversight. This creates a realistic possibility of "Ghost Commands"—unauthorized software overrides that could lead to physical sabotage or pipeline over-pressurization.

• Network Lateral Movement: Technical indicators suggest a realistic possibility that threat actors are attempting to utilize existing PDVSA joint-venture VPN tunnels to bridge into the internal systems of Western partners.

---

3. Intelligence-Based Risk Matrix

Group	Physical Risk	Cyber Risk	Economic/Legal Risk	Confidence
Oil Executives	EXTREME	HIGH	HIGH	High
HNWIs / PEPs	HIGH	HIGH	CRITICAL	Moderate
Maritime Assets	HIGH	HIGH	HIGH	High

---

4. Critical Indicators and Triggers

We will continue to monitor the following indicators to refine our confidence in the "State Collapse" judgment:

• Production Thresholds: PDVSA output falling below 500,000 bpd (Signals total failure of centralized infrastructure control).

• Credential Dumps: Identification of fresh PDVSA/JV-specific credentials on dark-web repositories.

• Diplomatic Movement: Emergency evacuation of Cuban or Russian mission personnel from Caracas.

Conclusion: Monadnock Cyber assesses that the removal of the central regime has decentralized the threat landscape. Western entities must isolate partner networks immediately, as the risk has shifted from state-led pressure to chaotic, multi-actor sabotage.

---

Who is Monadnock Cyber?

Monadnock Cyber is an AI-Driven Intelligence operation specializing in strategic on the intersection of volatility and industry. Our methodology integrates open-source AI-driven analysis with technical telemetry to provide forward-looking risk assessments. By leveraging large language models (LLMs) and neural networks, we synthesize vast streams of OSINT/TECHINT to identify emerging threats before they manifest on traditional corporate security dashboards.

Track exposure of your Executives or HNW principals: https://gingerbreadprivacy.com/