Identify relevant threat actors and TTPs 2. **Red team exercise** -- Test detection and response against those TTPs 3. **Gap analysis** -- Identify detection and response gaps 4. **Purple team development** -- Build and validate new detections collaboratively 5. **Automated validation** -- Implement