In an increasingly complex threat landscape, organisations are constantly seeking ways to improve their detection capabilities. The Center for Threat-Informed Defense’s recent update to “Summiting the Pyramid” framework offers a unique approach that emphasises the critical intersection of threat intelligence, detection engineering, and purple teaming.

Intelligence-Driven Detection Prioritisation

One of the most significant challenges security teams face is deciding where to focus their detection efforts. The Pyramid of Pain concept has long shown us that targeting adversary TTPs (Tactics, Techniques, and Procedures) creates the most impact. However, it is crucial the decision on which TTPs to focus is based on a strong collaboration with the cyber threat intelligence teams or partners. They can help inform these decisions based on likely adversaries and do to ATT&CK flow analysis to understand frequently used and commonly overlapping techniques. Without this teams might waste resources on less important detection strategies. Organisations need to leverage threat intelligence to understand which behaviors and TTPs deserve priority attention, enabling more focused and effective detection engineering efforts.

Breaking Down Silos: Detection Engineering Meets Threat Intelligence

While the technical aspects of detection engineering are crucial, the success of “Summiting the Pyramid” hinges on something equally important: effective knowledge sharing. This isn’t just about tools and techniques; it’s about creating an environment where expertise flows freely both within organisations and across the broader security community. The often-overlooked human element of detection engineering means ensuring that insights don’t stay siloed within individual teams. When a threat intel analyst discovers a new adversary technique, that knowledge needs to seamlessly flow to detection engineers. Similarly, when SOC analysts identify gaps in detection coverage, that feedback must reach both threat intel and engineering teams quickly.

Internal Knowledge Exchange

Within organisations, effective detection programs require:

• Regular knowledge transfer sessions between threat intel, detection engineering, SOC and read teams
• Documentation of detection logic and the reasoning behind it
• Shared understanding of adversary behaviors and detection strategies
• Clear communication channels between technical and non-technical stakeholders
• Collaborative post-mortem analyses of both successful detections and missed opportunities

The success of modern security programs increasingly depends on close collaboration between detection engineering and threat intelligence teams. The “Summiting the Pyramid” mindset emphasises this partnership, encouraging teams to work together to:

• Identify and prioritise critical techniques requiring detection
• Understand adversary evolution and adaptation
• Develop more robust and accurate detection strategies
• Continuously improve existing detections based on new intelligence

Validation Through Purple Teaming

A critical aspect often is the need for rigorous testing of detection capabilities. Purple teaming — the collaborative effort between red (offensive) and blue (defensive) teams — plays a vital role in validating detection effectiveness. This approach helps:

• Verify detection coverage against real-world scenarios
• Identify gaps in detection strategies
• Test detection resilience against various adversary techniques
• Refine and improve detection accuracy
• Receive inputs from teams with a strong adversarial mindsent on new techniques

The Network Detection Challenge

The framework’s expansion to include network-based detection is a significant step forward, but it comes with unique challenges in today’s remote-work environment. Organisations must:

• Adapt network detection strategies for distributed workforces
• Balance host-based and network-based detection capabilities
• Consider visibility challenges in cloud and hybrid environments
• Implement detection strategies that work across various network architectures

Looking Forward: Community Collaboration

For this framework to reach its full potential, the security community needs to embrace collaborative sharing of Detection Decomposition Diagrams (D3s) and experiences. As we move more workloads to the cloud, extending these concepts to cloud-native environments becomes crucial. The community’s collective expertise in adapting and applying these principles to cloud environments will be invaluable.

Conclusion

The evolution of “Summiting the Pyramid” represents more than just a framework update — it’s a call to action for security teams to think differently about detection engineering. By embracing intelligence-driven prioritisation, cross-team collaboration, and rigorous validation, organisations can build more effective and resilient detection capabilities.

The challenge now lies in how we as a community can share our experiences, contribute to the framework’s evolution, and collectively improve our ability to detect and respond to threats. Whether through sharing D3 diagrams, contributing to open-source detection rules, or participating in community discussions, each contribution helps strengthen our collective defence capabilities.