detection engineering

3 posts

Detection-as-Code Is Not About Git: Building a Program That Scales Without You

Most teams 'do DaC' by putting Sigma in a repo. That's the easy 20%. The capability that scales is a tested lifecycle, not a toolchain.

Mar 20, 2026 · 13 min read

#detection-as-code #sigma #detection-program #ci-cd

detection engineering advanced T1621

Alert Fatigue Is an Offensive Technique, Not a Tuning Problem

MFA fatigue has a MITRE technique ID. SOC alert flooding doesn't — same deliberate tactic, different target, and why your defenses keep failing.

Mar 10, 2026 · 14 min read

#hot-take #detection-program #threat-landscape #defense-evasion

detection engineering advanced

The Detection Funnel: How Your 80% ATT&CK Coverage Becomes a 6% Catch Rate

ATT&CK coverage % looks good in board decks. Here's why it compounds into a ~6% actual catch rate — and what Threat Detection Coverage actually means.

Mar 5, 2026 · 11 min read

#hot-take #metrics #detection-program #coverage