Introducing the Delta Research Team

Detection engineering is load-bearing for a whole lot of security programs, and it is one of the least visible jobs in the industry. The output is a few dozen lines of query that most of the org will never read. The work behind it — the part that decides whether those lines are worth anything — is invisible by default.

Today we are announcing Delta, Spectrum Security’s dedicated research team, built for the people doing that work. Headed by Dylan Williams, the team includes Anthony Jirouschek and Rich Alldrin.

What’s our job?

Think of Delta as Spectrum’s skunkworks: a small, elite R&D team built to operate at the edge of what is possible.

Our job is to take ideas that are highly experimental today — autonomous detection engineering, AI threat hunting, cyber simulation, self-improving agents, automated security research — and figure out how to make them work in the real world.

The goal is not to build demos.

It is to get experimental capabilities out of the lab, through the hangar doors, and into production.

100xing detection

With our focus on experimental, cutting-edge techniques, we end up having to build things that do not exist yet — formats, tooling, datasets, evaluation harnesses, and a lot of primary research into how technologies actually behave under attack.

Most of it is infrastructure the whole field is missing, so our default is to publish: open formats, open research, open tooling, released as we build them rather than long after we are done with them.

The Delta team’s first release is Tradecraft, a standardized, machine-readable format for storing the context necessary to properly design and implement threat detections.

This is the first of a lot more. Stay tuned, and join us as we turn detection engineering into the science it should be: detection engineering is the foundation a whole lot of security programs are built on, and it should be a great deal less thankless than it is.