detectionengineering.io

What It Is

Detection Engineering Maturity Matrix is a detection engineering maturity model proposed by Kyle Bailey. Its goal is to help the security community assess the maturity of detection capabilities and provide a high-level roadmap for organizations that are building or scaling detection engineering teams. It is not an EDR, SIEM, SOAR, or managed detection service, but rather an assessment framework.

Core Dimensions

The matrix is organized around three maturity stages: Defined, Managed, and Optimized. It covers people, process, technology, and detection operations. The people dimension looks at whether there are dedicated detection engineers, SMEs for different detection domains, and leadership support with resources. The process dimension emphasizes detection strategy, approval and release workflows, maintenance monitoring, metrics, and MITRE ATT&CK coverage tracking. The technology dimension focuses on log visibility, SIEM capabilities, log health alerts, latency monitoring, and Detection-as-Code, including version control, CI/CD, code review, linting, and testing. The detection dimension highlights threat intelligence-driven work, red team/purple team validation, TTP-based behavioral detection, alert enrichment, risk-based alerting, and automated response.

Pricing and Deployment

The text does not mention commercial pricing, subscriptions, payment methods, or enterprise support. Overall, it appears to be a free public methodology resource, and it notes that V1 is available on Github. Its deployment model is not traditional software deployment; instead, teams use the matrix internally for assessment, gap analysis, and roadmap planning.

Pros and Cons

Its strengths are its well-rounded structure and coverage of key areas from organization and process to SIEM, CI/CD, and response experience. It is especially useful for moving detection engineering from ad hoc rule writing toward engineered operations. It also emphasizes modern SOC practices such as MITRE ATT&CK, threat modeling, log SLAs, and automated testing. Its limitations are that it remains at the framework level and does not provide an automated assessment tool, implementation templates, APIs, or compliance certification information. Successful adoption depends on an organization’s existing logs, SIEM, staffing, and management capabilities.

Who It’s For and Access from China

It is suitable for SOC leaders, detection engineers, incident response teams, blue teams, and security architecture teams that want to assess detection capability maturity and plan build-out priorities. Access from China is not discussed in the source text, so domain reachability, network stability, and payment availability cannot be determined. For more localized alternatives, it can be combined with MITRE ATT&CK, SOC-CMM, SANS materials, and detection engineering best practices from domestic and international SIEM/SOAR platforms.