Zero to Trust? Bringing Application-Level Intelligence at Scale to Detection Engineering

The transformation to cyber resilience (CR) is a prioritized goal for most organisations world wide, as they are facing highly sophisticated adversaries with increasing resources, experience, and (insider) intelligence. Threat detection, a key pillar to improve CR, with a traditional focus on network activities, however, has not symmetrically evolved to cover application-level threat detection equally well, rendering it largely a blind spot. In this paper, we outline the lack of methodology to application-level detection engineering as a potential cause. Moreover, we position application intelligence as a key enabler to allow for high-quality, low-noise threat signatures, and sketch out an inclusive detection engineering method. Our contributions ultimately ask software features to inherently support selfawareness and-reporting on suspicious behaviours, thereby rendering threat-detection systems able to rely on the application and user context for determining cyberattacks.