Detection engineering × AI security

Wiston Lestin

Detection & response · detection-as-code & AI-driven security automation.

This is my permanent home on the web — the one place my writing, projects and ideas live, independent of whatever platform is in fashion. I build and measure detections, for classic logs and for the newer problem of attacks against AI systems, and I try to end in a measurement rather than an assertion.

Writing →

Essays and field notes on detection engineering and AI security.

Projects →

Open-source tools and platforms I've built.

Résumé →

Experience, skills and certifications — the full professional profile.

Latest writing

2026-07-07

Backtesting detection rules — including the ones for AI attacks

A lottery-prediction backtester, stripped of its models and repointed at Sigma rules. Two findings from real public data: a rule that was right and still blind, and keyword rules that catch under 9% of real jailbreaks.

Selected projects

Detection Rule Backtester

Backtest Sigma / ATR / KQL-style rules against real logs and AI-attack traces — precision, recall and ensemble confidence, per rule.

DefenderHunter

Detection-as-code threat-hunting framework for Microsoft Defender XDR & Sentinel — MITRE-mapped query packs.