The State of RSigma, Part Two: The Loop

One detection’s journey around the detection engineering lifecycle, and how far a single binary carries it The first State of RSigma ended with a sentence that was doing more work than it let on: “the direction of the work is to close the loop around it.” Detections tested like code, coverage measured rather than guessed, weak signals aggregated into strong ones, authoring that meets engineers…