Detection engineering × AI security

Wiston Lestin

Detection & response · detection-as-code & AI-driven security automation.

This is my permanent home on the web — the one place my writing, projects and ideas live, independent of whatever platform is in fashion. I build and measure detections, for classic logs and for the newer problem of attacks against AI systems, and I try to end in a measurement rather than an assertion.

Writing →

Essays and field notes on detection engineering and AI security.

Projects →

Open-source tools and platforms I've built.

Résumé →

Experience, skills and certifications — the full professional profile.

Latest writing

2026-10-24

In March, TLS certificates drop to 100 days. The ones nobody owns are what break.

The CA/Browser Forum schedule is fixed: a 100-day maximum from 15 March 2027. Renewal cadence doubles, and the certificates that break are the ones nobody owns.

Selected projects

Detection Rule Backtester

Backtest Sigma / ATR / KQL-style rules against real logs and AI-attack traces — precision, recall and ensemble confidence, per rule.

DefenderHunter

Detection-as-code threat-hunting framework for Microsoft Defender XDR & Sentinel — MITRE-mapped query packs.