What Procedures Actually Represent and Why They Are Critical to Your Defensive Strategy

**Executive summary:** This report argues that mapping attacks to high-level techniques (e.g., MITRE ATT&CK) is insufficient for reliable detection because techniques abstract away execution details; defenders should adopt procedure-led intelligence that captures exact commands, execution context, dependencies, and sequencing. It outlines the challenges of extracting procedures from fragmented sources and presents Tidal Cyber's Threat-Led Defense platform and its NARC AI engine as a method to convert unstructured procedure data into actionable, validated execution models for detection engineering and validation.