Backtesting is the practice of running a candidate detection rule against historical security data before it is deployed. Security teams use it to estimate how many alerts the rule would generate, how many would likely be false positives, and whether the logic actually matches the telemetry they collect.
This matters because a detection that looks strong on paper can become unusable if it is too noisy or too narrow. In detection engineering and detection-as-code workflows, backtesting helps analysts tune thresholds, compare rule versions, and reject brittle logic before it reaches production. It also supports faster use of threat intelligence by turning indicators or behaviors into testable detections. However, backtesting is only a preview: an attacker can change infrastructure, timing, or technique, and a rule that is clean in a historical window may still fail in live conditions.