Opinions are my own.
On the passive side perhaps include Insider Threat (often detached from IR) then, in between active & passive, Detection Eng., since it could sit in between both sides.
On the passive side perhaps include Insider Threat (often detached from IR) then, in between active & passive, Detection Eng., since it could sit in between both sides.