Practical guidance for detection engineering decisions and defensible security work.
65 resources
Recognize staging, archiving, transformation, and bulk collection as preparation for possible data movement while preserving legitimate backup, analytics, migration, and response explanation...
Interpret access to sensitive objects through subject, object, operation, purpose, peer context, and history without turning statistical deviation into a claim of malicious intent.
Detect fraud around payment, payroll, procurement, legal, and recovery workflows by protecting consequential state transitions and the authority and verification behind them.
Reason about external sharing, guest access, links, invitations, and delegated collaboration authority through resource sensitivity, audience, lifetime, and observed use.
Detect mailbox rules, forwarding, delegation, and permission changes by separating configuration, authority, message effect, and legitimate workflow context.
Read message trace, authentication results, routing, delivery, and mailbox events as separate evidence so email detections do not confuse sender claims with verified origin or delivery with ...
Design privacy-safe logging for prompts, retrieval, memory, model outputs, and tool actions by selecting the least sensitive evidence that can support a defined security decision.
Detect when an agent's exercised authority, tool sequence, target scope, or consequence exceeds the bounded purpose and confirmation policy of the initiating task.
Specify telemetry for AI tool calls and Model Context Protocol interactions that preserves caller, authority, operation, target, protected arguments, policy, result, and trace relationships.
Represent the initiating user, application, agent instance, model operation, delegated credential, tool, and target resource as distinct identities so agent actions remain attributable and b...
