Detection on BlueSquadron — Security engineering for AI systemshttps://bluesquadron.dev/tags/detection/Recent content in Detection on BlueSquadron — Security engineering for AI systemsHugo -- gohugo.ioen-usflorent.batard@gmail.com (Florent Batard)florent.batard@gmail.com (Florent Batard)Tue, 04 Aug 2026 00:00:00 +0000Secrust: When Adding Cores Made It Slowerhttps://bluesquadron.dev/posts/secrust-when-adding-cores-made-it-slower/Tue, 04 Aug 2026 00:00:00 +0000florent.batard@gmail.com (Florent Batard)https://bluesquadron.dev/posts/secrust-when-adding-cores-made-it-slower/A single-process Sigma correlation engine in Rust. Eight optimisation passes took the realistic workload up 301% — and then four threads made it 23% slower than two. Why that happened, what I shipped as the default, and the things I decided not to build.Cutting 90% of the Noise: Agent-Driven Security Operationshttps://bluesquadron.dev/posts/agent-driven-security-operations/Wed, 08 Jul 2026 00:00:00 +0000florent.batard@gmail.com (Florent Batard)https://bluesquadron.dev/posts/agent-driven-security-operations/Tuning detections until the volume fits your headcount means choosing your visibility based on your staffing. The fix is not more analysts — it is separating the three layers of triage by what each one is allowed to be wrong about.