Builds and validates detections, audits telemetry coverage, tests defensive resilience, correlates incident evidence, and synthesizes control evidence without inflating coverage.