Uploaded August 2025 | Updated September 2026, 11 hours ago
Martin Eian (mnemonic, NO)
Dr. Martin Eian is a Researcher at mnemonic. He has more than 20 years of work experience in IT security, IT operations, and information security research roles. In addition to his position at mnemonic, he is a member of the Europol EC3 Advisory Group on Internet Security. He has previously worked as the Head of Research at mnemonic, as an Adjunct Associate Professor at the Norwegian University of Science and Technology (NTNU), as a Threat Intelligence analyst at mnemonic, and as an Information Security Specialist at Nordea. He holds a PhD in Telematics from NTNU (2012). His current research topics are threat intelligence automation, quantitative cyber risk analysis, vulnerability measurements and analysis, and alert aggregation and contextualization. He has previously presented at the FIRST Annual Conference, the ONE Conference, and at Black Hat USA Arsenal.
Incident response teams need to determine what happened before and after an observation of adversary behavior in order to effectively respond to incidents. The MITRE ATT&CK knowledge base provides useful information about adversary behaviors, but provides no guidance on what most likely happened before and after an observed behavior. We have developed methods and open source tools to help incident responders answer the questions "What did most likely happen prior to this observation" and "What are the adversary's most likely next steps given this observation". To be able to answer these questions, we combine semantic modeling of subject matter expert knowledge with data-driven methods trained on data from computer security incidents.
Martin Eian (mnemonic, NO)
Dr. Martin Eian is a Researcher at mnemonic. He has more than 20 years of work experience in IT security, IT operations, and information security research roles. In addition to his position at mnemonic, he is a member of the Europol EC3 Advisory Group on Internet Security. He has previously worked as the Head of Research at mnemonic, as an Adjunct Associate Professor at the Norwegian University of Science and Technology (NTNU), as a Threat Intelligence analyst at mnemonic, and as an Information Security Specialist at Nordea. He holds a PhD in Telematics from NTNU (2012). His current research topics are threat intelligence automation, quantitative cyber risk analysis, vulnerability measurements and analysis, and alert aggregation and contextualization. He has previously presented at the FIRST Annual Conference, the ONE Conference, and at Black Hat USA Arsenal.
Incident response teams need to determine what happened before and after an observation of adversary behavior in order to effectively respond to incidents. The MITRE ATT&CK knowledge base provides useful information about adversary behaviors, but provides no guidance on what most likely happened before and after an observed behavior. We have developed methods and open source tools to help incident responders answer the questions "What did most likely happen prior to this observation" and "What are the adversary's most likely next steps given this observation". To be able to answer these questions, we combine semantic modeling of subject matter expert knowledge with data-driven methods trained on data from computer security incidents.
