#hot-take

3 posts

Your Threat Intel Program Is Measuring the Wrong Thing

Most CTI programs measure IOCs ingested and reports published — activity, not effect. Here's what operationalized intelligence actually looks like.

Mar 30, 2026 · 9 min read

#hot-take #threat-intel #CTI #detection-program

detection engineering advanced T1621

Alert Fatigue Is an Offensive Technique, Not a Tuning Problem

MFA fatigue has a MITRE technique ID. SOC alert flooding doesn't — same deliberate tactic, different target, and why your defenses keep failing.

Mar 10, 2026 · 14 min read

#hot-take #detection-program #threat-landscape #defense-evasion

detection engineering advanced

The Detection Funnel: How Your 80% ATT&CK Coverage Becomes a 6% Catch Rate

ATT&CK coverage % looks good in board decks. Here's why it compounds into a ~6% actual catch rate — and what Threat Detection Coverage actually means.

Mar 5, 2026 · 11 min read

#hot-take #metrics #detection-program #coverage