Senior Detection Engineer & Incident Responder
Marta K. is a senior detection engineer and incident responder with over eight years of hands-on experience operating and scaling security operations in high-growth SaaS and fintech environments. She started her career as a SOC analyst, working night shifts triaging alerts and investigating suspicious activity across endpoint, identity, and cloud environments. Over time, she moved into detection engineering, where she focused on building and tuning detection pipelines, reducing false positives, and mapping coverage to frameworks like MITRE ATT&CK. Marta has led incident response efforts for ransomware, credential compromise, and insider threat scenarios, and has helped teams transition from reactive alert handling to structured investigation workflows and proactive detection strategies. Her work has included implementing detection-as-code practices, improving alert fidelity, and designing playbooks that actually get used during real incidents. She writes about the reality of running security operations — from alert fatigue and broken escalation paths to what actually works when building detections and responding to incidents under pressure.
The first incident I owned end to end at a mid-market shop, I had every tool I needed and no order to run them in. We recovered, but we relearned the environment from scratch at 2 a.m. instead of reading it off a runbook. Mature DFIR is mostly the runbook.
Aug 8, 2026
The threat hunting program I inherited looked healthy on a slide: a hunt calendar, ATT&CK coverage in the high seventies, tidy quarterly reports. Not one hunt had changed a detection in eighteen months. This is how I separate a real hunt from a rebranded IOC sweep.
Aug 7, 2026
I carried a mostly-green ATT&CK heatmap into a detection review. Three weeks later an attacker walked straight through the exact technique the map called covered. After that miss, the first thing my team threw out was the coverage percentage.
Aug 3, 2026
Three weeks after we switched on an AI triage layer, I was at my desk at 1 am pulling its auto-closed alerts back out of the archive and re-running them myself. The queue had collapsed to a few dozen alerts. I did not yet trust a closure whose reasoning I had not seen.
Aug 3, 2026
The alert that taught me the most about social engineering never fired on the message. It fired eleven days later, on an Okta login from an anonymizing proxy against a Super Admin account our own help desk had reset. Every filter I owned had nothing to inspect, because the attack produced no message artifact at all.
Jul 25, 2026
Impossible travel on a finance account used to eat half an hour of my night, walking four consoles by hand to prove it was just a VPN. With an AI-assisted tool the enrichment was already assembled when the case reached me, so I started where the work needs a person. The AI compressed the mechanical parts, and I kept every judgment call.
Jul 25, 2026
The case hit my queue at 2:40 am: an Okta identity with a string of push denials two minutes apart, then a single success from the same IP. My detection only counted failures, so it nearly slid past me. An MFA fatigue attack is really two attacks at once, one in the identity logs where the SOC can see it and one on a phone at 1 am where nobody can. Here is how I detect both.
Jul 17, 2026
Three years ago I sat through an incident response tabletop that was pure theater: the scenario was circulated a week early, everyone read their lines, and someone ticked a compliance box. Six months later a real credential compromise broke everything the exercise had supposedly validated. A tabletop that can't be failed can't teach anything, and most are built exactly that way.
Jul 17, 2026
Threat hunters spend Tuesday testing one written hypothesis against messy data, not browsing logs for fun. The real output is a shipped detection or a documented gap, even when the hunt finds nothing.
Jul 11, 2026
Vishing hides in identity logs, not email or endpoint alerts, so the SOC sees the aftermath first. The real signal is a correlated trail: help-desk reset, risky re-enrollment, then anomalous sign-in.
Jul 10, 2026
Smishing hasn't stayed in the consumer fraud category it started in. The SMS attacks showing up in enterprise queues in 2026 are multi-stage credential harvesting campaigns: IT helpdesk impersonation, MFA code interception, RCS delivery that bypasses carrier filters. Most SOC tooling wasn't built to catch any of it.
Jul 4, 2026
The detection engineer job description says: write detection rules, map to ATT&CK, tune false positives. Most of what the role actually requires (debugging broken log pipelines, maintaining exclusion lists nobody documented, writing the investigation context that keeps a detection actionable months after it ships) never makes it into the posting.
Jul 4, 2026
A user-reported phish looked dead on arrival: clean sandbox, benign PDF, expired URL. The real compromise was already live in the identity plane as a replayed session token and an attacker-created OAuth grant, three hours before the runbook caught up.
Jun 26, 2026
I ran Prophet Security, Dropzone AI, and 7AI against 30 days of real production alerts instead of a curated demo, and the three diverged far more than the marketing suggests. The widest gaps showed up on the ambiguous cases, where the tool that scored best on raw accuracy turned out to be the weakest at explaining itself.
Jun 19, 2026
A green ATT&CK heatmap measures how many rules you've written, not whether any of them work. Start with the 20 detections that show up most often in real breach chains, validate each one, and only then expand.
Jun 19, 2026
An AI SOC agent closed an impossible-travel alert with a full evidence chain in under four minutes. It also recommended isolating a production server over clean traffic the same week. Marta Kowalska walks one real Entra ID alert through the agent's full investigation chain — and shows exactly where the reasoning broke on a different alert class.
Jun 15, 2026
The autonomous SOC demo cleared 40 curated alerts in under two minutes. Four hours into a real production queue on a Wednesday night, it had already stalled on a custom cloud detection, silently closed a dedup cluster, and skipped an alert that needed a Jira ticket to answer.
Jun 5, 2026
We shipped a hundred detections and the ATT&CK heatmap stayed green through fourteen broken rules, week-stale IOCs, and a log pipeline that had stopped exporting months earlier. Every failure traced to the same root: we treated detection engineering as rule writing and skipped the maintenance.
Jun 5, 2026
Most MDR vendors arrive at renewal with a polished QBR deck. Most customers arrive with nothing to push back with. That asymmetry is the whole game — and it's why flat escalation rates, unaudited closed verdicts, and a 2 AM analyst who knows nothing about your environment survive contract after contract. This piece is the counter-metric.
Jun 5, 2026
Sigma solved detection portability but not tuning, conversion fidelity, or cloud coverage. Where the format still delivers value and where teams over-rely on it.
Jun 3, 2026
Cloud security monitoring for 3-5 person SOC teams: four pillars, co-managed MDR, telemetry strategy, and where most stacks fail.
Jun 2, 2026
Year one of our purple program produced slide decks, not detections. Here's the structural diagnosis and the pipeline model that fixed it.
May 25, 2026
AI triage hasn't moved alert fatigue. The structural causes start upstream. Here's what to fix before another AI SOC pilot.
May 12, 2026
Detection engineering stalls when it's treated as a person, not a function. Here's what the function actually owns, and how to build it from Level 0.
May 11, 2026
Most IRPs are written for auditors, not analysts. Here's what a usable incident response plan actually contains, plus a stripped-down template.
May 10, 2026
Practitioner takes on SOC modernization, detection engineering, threat hunting, and more. No fluff. No product pitches.