Build a small attack-and-defence feedback loop: separate roles, verify network boundaries, collect the expected evidence and improve one detection at a time.