Rethinking Detection Engineering: A Practical, Threat-Informed Path Forward for Modern Security Teams

This content is provided free of charge through collaboration between SANS and its sponsor(s). If you prefer not to share your contact details with the sponsor(s), you have the option of waiting approximately 30 days after the original publication date. After 30 days, to download the content, you will be required to create a SANS account, but your information will not be shared with the sponsor(s).

I consent to sharing my information with SANS and the sponsor(s) listed below for this paper. This information includes your name, title, organization, state, country, phone number and email address. Each organization will use your details in accordance with their respective privacy policies. You can review the SANS privacy policy below and the sponsors' privacy policies on their websites which are accessible by clicking on their logos below. By proceeding, you acknowledge and agree to these terms and the processing of your personal data by SANS as described in our Privacy Policy.

Rethinking Detection Engineering: A Practical, Threat-Informed Path Forward for Modern Security Teams (PDF, 0.93MB)Published: 24 Feb, 2026

Created by:

Erik Van Buggenhout & Stamatis Chatzimangou

Thank You To Our Sponsor

The threat landscape is evolving faster than ever, with defenders facing an explosion of data, technologies, and attack surfaces. This rapid evolution demands that detection engineering become faster, more adaptive, and more efficient. Yet, despite the evolution of frameworks, practices, and tools, maintaining a detection library is still challenging for most teams.

Detection Engineering That Scales: Practical Strategies for Resilient, Maintainable Security Operations

Related Webcast

Join SANS Senior Instructor Erik Van Buggenhout, Splunk’s Director of Product Management Tim Nary, and NVISO Detection Engineering SME Stamatis Chatzimangou as they explore effective detection engineering.

Meet Your Authors

Erik Van Buggenhout

Senior Instructor

NVISO co-founder and SANS Senior Instructor, leading cybersecurity education in advanced adversary tactics. Experienced in offensive security with extensive background in penetration testing and ethical hacking across Europe.

Learn more

Stamatis Chatzimangou

Stamatis is a detection engineering subject matter expert with over a decade of hands-on experience in cybersecurity operations. He has worked with multiple MSSPs, defending environments in the EMEA region in roles ranging from L1–L3 SOC Analyst to SOC Engineer and Detection Engineer.