All Posts

5 posts — filter by category, tag, or difficulty

Category:

Difficulty:

Tags:

The 57,000-Rule Illusion: What Changed in Public Detection Content

57,602 rules across 25 public repos: where content is growing, where ATT&CK coverage breaks down, and why raw counts deceive.

Oct 28, 2026 · 7 min read

#detection-engineering #mitre-attack #sigma #yara

detection engineering advanced

Your Board Doesn't Care About T1078: A Detection Coverage Model in the Language of Business Risk

216 technique IDs are not a decision surface. Translate detection coverage into named threats against crown-jewel assets, in dollars, with drill-down.

May 25, 2026 · 16 min read

#metrics #detection-program #coverage #leadership

threat intel advanced

AI Agents as Attack Surface: Detect the Action, Not the Prompt

An AI agent is a non-human identity with an opaque decision layer. You can't detect the prompt injection, so watch what the agent's credential does.

Apr 15, 2026 · 13 min read

#ai-agents #ai-security #llm #prompt-injection

threat intel intermediate T1078.004

45 to 1: Non-Human Identities Are Your Biggest Detection Blind Spot

You have ~45 non-human identities per human, and the signals your detection runs on (MFA, impossible travel, login geo) don't exist for any of them.

Mar 15, 2026 · 16 min read

#nhi #identity #cloud #ai-agents

detection engineering advanced

The Detection Funnel: How Your 80% ATT&CK Coverage Becomes a 6% Catch Rate

ATT&CK coverage % looks good in board decks. Here's why it compounds into a ~6% actual catch rate, and what Threat Detection Coverage actually means.

Mar 5, 2026 · 11 min read

#hot-take #metrics #detection-program #coverage