Detection and mitigation are the defensive steps used to notice hostile activity and limit its impact. Detection means identifying suspicious behavior, such as unusual logons, privilege changes, lateral movement, or directory abuse. Mitigation means reducing the chance that the activity succeeds or spreads, for example by revoking access, isolating systems, tightening controls, or blocking known attack paths.
In cyber security, the two work together. Good detection gives defenders visibility into attack techniques, especially in identity systems like Active Directory where small changes can have wide effects. Good mitigation lowers risk even when an attacker gains a foothold, because hardening, segmentation, least privilege, and rapid response can stop credential theft or trust abuse from turning into full compromise. Technique-based guidance is valuable because it maps each attack method to specific alerts and control improvements.