Detection is a critical part of security operations. We expect detection from our security vendors with the expectation they will help prevent attacks. What's the truth? What technologies/methodologies underly detection and what value do they provide, and do they meet our expectations or disappoint?

In this talk, I'll review the history of detection, how it has changed over time, and question our expectations on applying technology to detection and if we are missing a way to do it better.