#metrics

4 posts

Your Board Doesn't Care About T1078: A Detection Coverage Model in the Language of Business Risk

216 technique IDs are not a decision surface. Translate detection coverage into named threats against crown-jewel assets, in dollars, with drill-down.

May 25, 2026 · 16 min read

#metrics #detection-program #coverage #leadership

detection engineering advanced

MTTD Is a Lagging Indicator You Can Game to Zero

MTTD and dwell time only exist after a breach and reward alert volume. Keep them as the board scoreboard; steer your program on leading indicators.

Apr 30, 2026 · 15 min read

#metrics #detection-program #hot-take

threat intel intermediate

Your Threat Intel Program Is Measuring the Wrong Thing

Most CTI programs measure IOCs ingested and reports published: activity, not effect. Here's what operationalized intelligence actually looks like.

Mar 30, 2026 · 9 min read

#hot-take #threat-intel #CTI #detection-program

detection engineering advanced

The Detection Funnel: How Your 80% ATT&CK Coverage Becomes a 6% Catch Rate

ATT&CK coverage % looks good in board decks. Here's why it compounds into a ~6% actual catch rate, and what Threat Detection Coverage actually means.

Mar 5, 2026 · 11 min read

#hot-take #metrics #detection-program #coverage