Catching the Attack Was Not the Same as Detecting the Sequence

I wrote a suite for one class of authorization failure, scored my own gates with it, and a reviewer...