Detection gaps and IOFAs shift SOC teams toward preemptive defence

At a glance

What this is: This is a Silent Push analysis of why IOC-based defence lags behind adversary activity and how IOFAs and Traffic Origin aim to move detection earlier in the attack lifecycle.

Why it matters: It matters because SOC and IAM teams need controls that act before phishing infrastructure and suspicious access patterns become incidents, not just after alerts fire.

Context

Security teams often build around the detection gap, the delay between adversary activity and the moment monitoring tools raise an alert. When defences rely on indicators that describe past compromise, they tend to improve after the fact rather than before the attack path completes.

This article reframes that problem around staged infrastructure and origin intelligence, which is why it has relevance beyond email security and into identity workflows. When a session, login, or onboarding event comes from routed infrastructure, teams need context before they trust the request.

Key questions

Q: How should SOC teams stop reacting only after phishing infrastructure is already live?

A: SOC teams should move part of their control stack upstream, where infrastructure is being staged, not just where it is delivered. That means feeding DNS, domain registration, and web scan intelligence into blocking and orchestration tools so suspicious infrastructure is stopped before the first message or request reaches a user.

Q: Why do traditional indicators of compromise create a detection gap?

A: Because they describe past activity, not emerging activity. By the time an IOC is available, the attack has already happened, which makes it useful for hunting and incident response but weak for prevention. Teams close that gap only when they add signals that identify preparation, staging, or abnormal trust conditions earlier in the chain.

Q: What are the signs that a phishing campaign is being staged rather than merely observed?

A: Fresh domain registrations, rapid infrastructure changes, short-lived hosting patterns, and repeated movement across providers are all signs that a campaign may be in preparation. Those signals become more actionable when they are correlated continuously instead of waiting for a campaign to generate a conventional blocklist entry.

Q: How should identity teams use traffic origin data in risk decisions?

A: They should treat traffic origin as a trust signal, not a standalone verdict. If a session appears local but upstream origin points elsewhere, the right response is usually step-up authentication, session holding, or manual review, depending on policy and sensitivity. That approach is most useful when identity and fraud teams share the same risk threshold.

Technical breakdown

Why IOC-driven defence always arrives late

Indicators of compromise are retrospective by design. They describe domains, hashes, and artifacts that were already used in an attack, so they are best suited to hunting, retrospective validation, and cleanup. In phishing, that delay is especially costly because adversaries can register infrastructure, run a campaign, and abandon it before the indicator reaches gateways or blocklists. The architectural limit is simple: an IOC can confirm that malicious activity happened, but it cannot represent the infrastructure being assembled right now. See the Threat Intelligence Guide. See the Threat Intelligence Guide.

Practical implication: Treat IOCs as confirmation data and pair them with earlier-stage telemetry if you want to stop campaigns before delivery.

How IOFA-style staging signals change detection engineering

Indicators of Future Attack move the analytic focus from known-bad artifacts to the patterns that appear while adversary infrastructure is being created and managed. That means continuous collection across DNS, web scans, and infrastructure movement, then correlation against staging behaviours such as newly registered domains, rapid provider changes, and infrastructure that looks built for short-lived abuse. This is closer to prevention engineering than classic hunting because the signal is about preparation, not aftermath. It also changes the control point from inbox or firewall enforcement to upstream staging detection. See the Detection Engineering Guide. See the Detection Engineering Guide.

Practical implication: Build detections that score staging behaviour, not just known-bad indicators, so enforcement can happen before campaign launch.

Why traffic origin matters more than the visible IP

A visible IP address tells you where traffic appears to come from, not where the user or actor is actually located. Residential proxy networks, remote routing, and proxy services can all separate the observed address from the upstream origin. Traffic Origin adds that hidden context, which matters for authentication, onboarding, fraud review, and insider-risk workflows because the decision is no longer based on a single network attribute. The control value is not geolocation alone, but whether the origin data changes the trust decision before access is granted or a session continues.

Practical implication: Use upstream origin context to trigger step-up checks or hold risky sessions before the request is fully trusted.

Threat narrative

Attacker objective: The attacker wants to run a short-lived campaign from newly staged infrastructure before defenders can classify and block it.

1. Entry begins when adversaries register fresh phishing infrastructure and place it into service before defenders have populated traditional blocklists.
2. Credential harvesting or trust abuse follows when users receive convincing phishing content from that staged infrastructure and interact with it before alerts catch up.
3. Impact occurs when the campaign lands before enforcement, giving the attacker a short window to steal credentials or deliver fraudulent content at scale.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Detection gap management is now a control problem, not just a monitoring problem. A SOC that only sees what happened has already ceded timing to the attacker. The article correctly pushes practitioners toward earlier-stage signals, because the operational question is no longer how fast you can alert, but how far upstream you can enforce. That shift matters for identity and access decisions as much as it does for network blocking.

IOFA is a useful named concept because it captures a missing class of signal. Traditional intelligence workflows optimize for known badness, while staging intelligence optimizes for malicious preparation. That distinction matters because infrastructure creation is often the only point where defenders can still intervene before a campaign produces victims. Practitioners should treat staging visibility as a distinct governance layer, not as a nicer IOC feed.

Traffic origin closes a trust gap that looks like identity but presents as network data. A login or onboarding event can appear local while actually originating through proxy infrastructure, and that makes the decision boundary a trust problem rather than a simple geolocation problem. For identity teams, this is where threat hunting and access controls intersect: origin context should influence whether a session is accepted, challenged, or isolated.

This approach strengthens preemptive defence, but only if the enforcement path is real. Detecting staged infrastructure has little value if the feed never reaches proxies, gateways, SOAR playbooks, or SIEM workflows quickly enough to matter. The category will mature when teams measure how often upstream signals change a decision, not how many alerts they generate. Practitioners should judge success by prevention rate, not alert volume.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: Detection Engineering Guide

What this signals

Upstream visibility is the real differentiator: when defenders can see infrastructure being created, they can influence the decision before phishing content is sent or a session is trusted. That is a better prevention model than waiting for blocklists to catch up, and it shifts the SOC from reaction to interception.

Origin-based trust decisions will matter more as proxy use normalises. The visible IP will keep becoming less reliable as a risk signal, which means fraud, IAM, and SOC teams need richer context about where traffic actually originates. The organisations that win this transition will be the ones that wire that context into policy, not just reporting.

Secrets leakage outside code now shows how broadly the detection boundary has moved: 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks. That reinforces the same lesson as this article: control points have to move closer to where activity starts, not where teams are accustomed to looking.

For practitioners

• Instrument upstream staging signals Prioritise DNS, web scan, and infrastructure movement data that reveal when hostile domains are being created rather than when they have already been used.
• Route IOFA feeds into enforcement points Push staging intelligence into proxies, firewalls, email gateways, and SOAR so suspicious infrastructure is blocked before users request it.
• Use origin context in access decisions Feed Traffic Origin into authentication, onboarding, and fraud workflows so step-up checks can trigger when observed location and upstream origin diverge.
• Measure prevention, not alert count Track how often upstream intelligence changes a block, hold, or investigation outcome, rather than counting only the alerts the SOC receives.

Key takeaways

• The core risk is timing, because controls that only see known-bad artifacts will always trail adversary staging and delivery.
• The article's model pushes defence earlier by treating infrastructure creation and traffic origin as decision-grade signals.
• Practitioners should connect upstream intelligence to blocking, step-up checks, and orchestration if they want measurable prevention rather than better hindsight.

Related NHI Mgmt Group resources: Detection Engineering Guide · Threat Hunting Guide · Threat Intelligence Guide · Slack GitHub breach 2022

Key terms

• Detection Gap: Detection gap is a period, technique, or environment where malicious activity is not visible to existing controls or analysts. It leaves attackers free to operate without alerting, so teams identify gaps by testing detections, reviewing telemetry coverage, and checking whether critical assets generate the logs needed to investigate.
• Indicator Of Compromise: A measurable sign that suspicious or malicious activity may have occurred, such as an IP address, hash, domain, email, or credential artifact. In operational programmes, an IOC only matters when it can be normalized and used in detection or response workflows.
• Indicator Of Future Attack: An indicator of future attack is infrastructure, behaviour, or content that suggests an adversary is preparing a campaign before compromise is visible. It shifts detection from after the breach to before execution, which is critical for preemptive defense and AI-assisted triage.
• Traffic Origin: Traffic Origin is contextual data that helps identify where network traffic actually originates, not just where the visible IP address is registered. It is especially useful when proxies, routing layers, or residential networks mask the real upstream source behind an apparently local session.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the wider security stack they already run.