Detection engineering is the half of the job nobody buys

Nobody buys detection engineering. They buy the attack, and the report, and then they file it. The half that would actually change next year is the half that gets cut from the scope first.

We now finish every engagement by writing detection rules for what we did, mapped to the specific techniques, and then running the same routes again to see whether they fire. Half the time they do not, because the rule was written against the tool rather than the behaviour.

A red team that leaves no detections behind is a very expensive way to be told you are insecure.