Insights/Detection & Response

Threat Detection & Response

Detecting and responding to attacks: MDR, the SOC, the SIEM/EDR/XDR stack, and the incident response plan you write before you need it.
All writingOffensive SecurityApplication & Cloud SecurityDetection & ResponseSecurity Program & RiskAI Security
§ 015 articles
01
Threat Detection & Response
Managed detection and response (MDR): what it is and when you need it
MDR is a team that watches your environment, decides what is real, and acts when it matters. See how it differs from SIEM, MSSP, and EDR, and when to buy it.
May 26, 2026
12 min read
→02
Threat Detection & Response
What a Security Operations Center (SOC) does
A SOC is the team and tech that watch your environment around the clock and triage what matters. See the roles a SOC needs and when to build one in-house.
Jun 16, 2026
11 min read
→03
Threat Detection & Response
SIEM, EDR, and XDR: what's the difference
SIEM, EDR, and XDR are detection tools that get confused constantly. See what each one does, how they differ, and how they fit together as one defense.
Jun 16, 2026
10 min read
→04
Threat Detection & Response
How to build an incident response plan
A plan you write for the first time during an attack is worthless. See how to build an incident response plan, the phases it covers, and how to rehearse it.
Jun 16, 2026
10 min read
→05
Threat Detection & Response
Most alerts are noise. The job is the signal.
A detection program that pages you for everything trains you to ignore the one alert that matters. Here is how to separate real signal from noise in MDR.
Apr 30, 2026
14 min read
→