At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in.

The alert tells you something happened. However, gaining access to your network doesn’t necessarily mean attackers have stolen data or disrupted the systems they were targeting. They may need to obtain additional access, move to another machine, or further explore the network. Being able to see and understand that activity is the intervention opportunity.

People naturally gravitate toward detections during product evaluations. They’re tangible, easy to compare and quantify, and address the question everyone wants an answer to: Will they catch the attack? There’s often an assumption that the rest will follow, meaning, if the detections are good, surely the investigation will be as well, right?

Whether you can trace the attack, understand the scope, and respond in time to intervene depends largely on the data behind that detection. In network security, a product can have good detections and still leave an analyst struggling to investigate. Perhaps the analyst can see the connection that triggered the alert but can’t follow what happened next. If a search returns nothing, does that mean the activity didn’t happen or that you weren’t collecting the evidence needed to see it?

This, and the arrival of AI defense, is why data quality has recently been getting so much attention.

Source link