Fluency in modern attacker tradecraft, including credential theft, session abuse, phishing, malware execution, persistence, privilege escalation, lateral movement, command and control, and exfiltration, and in how each shows up in telemetry. Detection coverage is owned by this team working with our AI agents: you find the gaps and decide what good looks like, the agents draft the rule logic, and you assess, tune, and decide what goes live.