Skip to content

It's M̶a̶p̶s̶ Gaps All the Way Down

Security researchers examine technical aspects of It's M̶a̶p̶s̶ Gaps All the Way Down.

Summary

Dave Hull explains why detection and incident response are hard, covering false positives and negatives, incomplete EDR telemetry, and analyst bias. Explores map-versus-territory thinking and suggests adding context, annotations, outcome data, and better detection-engineering practices.

Related talks