Detection engineering × AI security

Wiston Lestin

Detection & response · detection-as-code & AI-driven security automation.

This is my permanent home on the web — the one place my writing, projects and ideas live, independent of whatever platform is in fashion. I build and measure detections, for classic logs and for the newer problem of attacks against AI systems, and I try to end in a measurement rather than an assertion.

Writing →

Essays and field notes on detection engineering and AI security.

Projects →

Open-source tools and platforms I've built.

Résumé →

Experience, skills and certifications — the full professional profile.

Latest writing

2026-07-12

My detection models score 100% on everything. That's a red flag, not a feature.

A weekend detection lab, sixteen trained models, perfect metrics on almost every row — and why the most honest number on the dashboard was a 0.0%.

Selected projects

Detection Rule Backtester

Backtest Sigma / ATR / KQL-style rules against real logs and AI-attack traces — precision, recall and ensemble confidence, per rule.

DefenderHunter

Detection-as-code threat-hunting framework for Microsoft Defender XDR & Sentinel — MITRE-mapped query packs.