Suspect a breach? Report it immediately — response within 1 hour.Report an incident
Detection rules are built from documented incidents at comparable organizations, not from a generic vendor catalogue.
Detection & monitoring
Most detection rules available on the market come from generic catalogues supplied by security vendors. They are designed to apply to as many clients as possible, without regard to industry, geography, or the techniques actually observed against comparable organizations.
PIBD inverts this logic. The detection rules deployed for a client are built from documented incidents that affected organizations in its peer group — same sector, comparable size, same geography, similar exposure. Detection then targets techniques with a demonstrated history of use against this type of organization, rather than the full theoretical technique catalogue.
PIBD is applied in seven steps, from defining the peer group to periodic reassessment.
Define the peer group
The comparison group is delimited by industry, organization size, geography, and exposure level (attack surface, visibility, asset criticality).
Collect documented incidents
Public or documented incidents affecting this peer group are collected from open sources, vendor and sector body reports, and the threat intelligence tracked by EBH Security.
Reconstruct the attack chains
Each collected incident is broken down into an attack chain and mapped to the MITRE ATT&CK framework, technique by technique.
Compare against existing capabilities
The techniques identified are checked against the detection rules already deployed for the client, to establish the actual coverage state.
Identify uncovered techniques
Techniques documented among peers but not detectable in the client's environment are isolated and prioritized.
Build, deploy, and document the missing rules
A detection rule is written, tested, and deployed for each prioritized uncovered technique, with accompanying documentation (logic, data source, expected false positives).
Validate by simulation, then reassess quarterly
Each newly deployed rule is validated with a simulation scenario. The full cycle — collection, comparison, deployment — is rerun quarterly to track how threats against the peer group evolve.
Coverage achieved is measured by the MITRE ATT&CK technique coverage rate across the supervised perimeter — the proportion of techniques relevant to the client's peer group for which a detection rule is actually deployed and validated. This indicator is tracked continuously and reported in every monthly monitoring report.
PIBD is built into the Managed SOC & MDR service, and can also be applied upfront to assess the existing detection coverage of an already supervised environment.
