Validation as a planned next step

I proposed checking existing coverage against the observed activity, assigning missing-data and rule-development work, and using purple-team testing to validate the resulting detections. This placed testing after implementation and kept an ATT&CK mapping distinct from evidence that a detection actually worked.