Wiston Lestin

Detection & response — detection-as-code and AI-driven security automation.

I build and measure detections. These are my working notes: rules, harnesses, and honest numbers from real data — for classic logs and for the newer problem of attacks against AI systems. I care more about whether a detection actually holds up on historical data than about how clever it looks, so most posts here end in a measurement rather than an assertion.

The tools behind the posts are open source, and every figure I quote is meant to regenerate from a script. If a number can't be reproduced, it doesn't belong in a post.

Elsewhere

• Résumé — full profile: experience, skills and certifications.
• GitHub — code, including the Detection Rule Backtester.
• LinkedIn — background and contact.