Rethinking How You Work With Detection and Response Metrics

**Executive Summary:** At Black Hat Asia, Airbnb engineer Allyn Stott urged security teams to rethink how they measure detection and response effectiveness, emphasizing that raw alert volume is insufficient. He highlights practical challenges of metric engineering, warns against trying to cover every variation in MITRE ATT&CK, and introduces the TDR Maturity Model and the SAVER framework to prioritize techniques, align metrics with business risk, and drive measurable improvements with CISO buy-in.