Insights/Detection & Response

Threat Detection & Response

Detecting and responding to attacks: MDR, the SOC, the SIEM/EDR/XDR stack, and the incident response plan you write before you need it.
All writingOffensive SecurityApplication & Cloud SecurityDetection & ResponseSecurity Program & RiskAI Security
§ 015 articles
01
Threat Detection & Response
Managed detection and response (MDR): what it is and when you need it
MDR is a team that watches your environment, decides what is real, and acts when it matters. Here is how it differs from a SIEM, an MSSP, and an EDR tool, and when it is worth it.
May 26, 2026
12 min read
→02
Threat Detection & Response
What a Security Operations Center (SOC) does
A SOC is the team and technology that watch your environment around the clock, triage what matters, and drive the response. Here is what a SOC does, the roles it involves, and when to build one versus buy the capability.
Jun 16, 2026
11 min read
→03
Threat Detection & Response
SIEM, EDR, and XDR: what's the difference
SIEM, EDR, and XDR are three foundational detection tools that get confused constantly. Here is what each one does, how they differ, and how they fit together as one defense.
Jun 16, 2026
11 min read
→04
Threat Detection & Response
How to build an incident response plan
A plan you write for the first time during an attack is worthless. Here is how to build an incident response plan, the phases it covers, and why it has to be rehearsed before you need it.
Jun 16, 2026
12 min read
→05
Threat Detection & Response
Most alerts are noise. The job is the signal.
A detection program that pages you for everything trains you to ignore the one that matters.
Apr 30, 2026
14 min read
→