<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"><channel>
  <title>Nuculair blog</title><link>https://nuculair.com/blog/</link><description>Investigation, privacy and method.</description>
  <item><title>Canadian Tire's 38-million-account breach, eight months on: what an attacker can still piece together</title><link>https://nuculair.com/blog/canadian-tire-breach-eight-months-later/</link><guid>https://nuculair.com/blog/canadian-tire-breach-eight-months-later/</guid><pubDate>Thu, 15 Oct 2026 12:00:00 GMT</pubDate><description>The breach is old news. The data isn't. How one leaked record connects to the rest of someone's footprint, and what to do about it today.</description></item>
  <item><title>Inside the loop: how an AI investigator decides what to look at next</title><link>https://nuculair.com/blog/inside-the-investigation-loop/</link><guid>https://nuculair.com/blog/inside-the-investigation-loop/</guid><pubDate>Thu, 15 Oct 2026 12:00:00 GMT</pubDate><description>Perceive, select, plan, act, shape, interpret, challenge, integrate. A walk through the cycle Nuculair runs up to twenty times on every case, and why it argues with itself before it reports.</description></item>
  <item><title>Only expand what an operator confirms: the rule that keeps an AI investigator on the right person</title><link>https://nuculair.com/blog/only-expand-what-an-operator-confirms/</link><guid>https://nuculair.com/blog/only-expand-what-an-operator-confirms/</guid><pubDate>Thu, 15 Oct 2026 12:00:00 GMT</pubDate><description>The biggest risk with automated investigation isn't missing something. It's building a second life for the wrong person. Here's the rule we built Nuculair around.</description></item>
</channel></rss>
