Detection gaps keep breach response too slow for cyber resilience

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Crytica Security's blog post: Cybersecurity detection gaps keep breach identification and containment too slow for modern response models.

Why it matters: For IAM, NHI, and security operations teams, the issue is not only alert volume but the time lost before a real compromise is recognised and acted on.

By the numbers:

• The average time to identify and contain a data breach was 277 days, according to IBM's 2022 Cost of a Data Breach research cited by Crytica Security.
• The average cost of a data breach was $4.35 million USD, according to IBM's 2022 Cost of a Data Breach research cited by Crytica Security.

Context

Cybersecurity programmes often fail at the point where intrusion becomes visible, because protection-heavy architectures assume the perimeter will absorb most attacks. In practice, attackers spend time in environments before defenders know they are present, and that dwell time drives cost, operational disruption, and missed containment opportunities.

The detection problem is especially acute where cloud, remote work, and distributed assets have widened the attack surface faster than operational monitoring matured. For identity and access programmes, that means authentication events, device trust, and anomaly handling need to be treated as detection inputs, not just access-control records.

Key questions

Q: How do security teams reduce attacker dwell time during Windows incidents?

A: Teams reduce dwell time by combining real-time runtime detections with fast asset discovery and a unified alert workflow. Natural language search helps analysts locate the right Windows assets quickly, while centralised telemetry keeps investigations in one place. The goal is to move from manual searching to immediate context, so response starts before an incident spreads.

Q: Why does poor detection make zero trust less effective?

A: Zero trust relies on continuous verification, so weak detection leaves attackers free to move after the first control passes. Timely signals from logs, endpoint telemetry, identity events and network alerts are needed to spot compromised accounts, abnormal privilege use and lateral movement quickly enough to trigger containment, session revocation or step-up authentication.

Q: How does continuous monitoring improve endpoint security?

A: Continuous monitoring improves endpoint security by collecting ongoing telemetry from processes, logins, network connections, file changes and security controls on each device. That visibility helps detect malware, unauthorised software, privilege abuse and suspicious process changes early, so response tools can isolate the endpoint, kill malicious activity and preserve evidence.

Q: What is the difference between detection and response in security operations?

A: Detection identifies and contextualises suspicious activity, while response contains, remediates, and coordinates action across tools and teams. In practice, SIEM supports the first function and SOAR supports the second, and mature programmes need both to avoid either blind spots or slow containment.

Technical breakdown

Why dwell time matters more than alert volume

Dwell time is the period between intrusion and detection, and it is often the decisive variable in whether a security team can contain an incident before it spreads. A noisy alert stream can make teams slower if analysts must sort low-quality detections before they reach the real signal. The architectural problem is not simply missing alerts, but producing alerts that are too broad, too late, or too costly to investigate at scale. See the Detection Engineering Guide.

Practical implication: Tune detections for speed and fidelity so analysts spend less time triaging false positives and more time on real compromise signals.

How continuous monitoring changes endpoint and IoT detection

Continuous monitoring shifts detection from periodic checks to near-real-time inspection of device state, process activity, and code changes. That matters for endpoints, servers, and IoT assets because malware and living-off-the-land activity can execute between scheduled scans. Smaller probes and distributed analytics reduce overhead, but the real technical value comes from watching for execution changes and tampering as they happen, rather than after the fact. See the Device and IoT Identity Guide.

Practical implication: Extend monitoring to the full asset mix, including IoT and edge devices, so tampering and executable changes are visible as they occur.

Why zero trust still depends on detection quality

Zero trust reduces implicit trust, but it does not eliminate the need to identify suspicious behaviour quickly. Re-authentication, conditional access, and granular device trust all depend on reliable signals that tell the control plane when something is wrong. If detection is weak, zero trust becomes a static policy layer rather than an adaptive security model, and the organisation still learns about compromise too late.

Practical implication: Treat detection telemetry as a dependency of zero trust enforcement, not a separate monitoring project.

NHI Mgmt Group analysis

Detection latency is now a governance problem, not just a tooling problem. When organisations optimise only for prevention, they leave a long window in which attackers can operate before any response begins. That window drives cost, staffing pressure, and poor board visibility into real resilience. Practitioners should measure detection as a first-class control outcome, not as a side effect of logging.

Zero trust does not close the detection gap by itself. More authentication and tighter trust decisions help, but they still rely on trustworthy signals about device and user behaviour. If those signals are weak, the programme becomes policy-heavy and response-light. SOC operating models need telemetry that can separate legitimate access from active compromise in time to matter.

Dwell time compression: the real competitive variable in modern security is how quickly defenders can move from first signal to containment. That changes the value of alerting from volume to precision, and it pushes security teams to invest in signal quality, investigation workflows, and response authority. The practical conclusion is simple: if detection is slow, every downstream control starts late.

Security operations maturity now depends on alert economics. Teams do not just need more detections, they need fewer, better ones that preserve analyst time for the incidents that matter. That is why detection engineering, prioritisation, and automation belong in the same operating conversation. The practical conclusion is to redesign detection around decision speed, not alert count.

The detection gap exposes an identity-adjacent failure mode. In distributed environments, access events, device trust decisions, and re-authentication triggers are only useful if they arrive early enough to influence containment. That makes identity telemetry part of the detection stack, not just the access stack. The practical conclusion is to connect trust decisions directly to response workflows.

From our research library:

• Breaches involving stolen or compromised credentials take an average of 292 days to identify and remediate, according to IBM’s Cost of a Data Breach.
• Read next: Security Operations Metrics Guide

What this signals

Detection engineering is becoming the pressure point for modern security programmes. When response windows are measured in minutes, organisations cannot rely on broad alerts and manual triage to catch real compromise in time. The next step is to treat detection logic, coverage, and tuning as a governed programme rather than a collection of ad hoc rules.

Identity telemetry has to feed the response loop. Access anomalies, re-authentication triggers, and device trust signals become more valuable when they are wired into containment decisions rather than left in reporting dashboards. That is especially true as remote work and distributed assets keep expanding the places where compromise can hide.

For practitioners

• Measure dwell time as a core security KPI Track time to detect, investigate, and contain separately so leadership can see where response actually stalls.
• Prioritise high-fidelity detections over alert volume Reduce low-value alerts and tune detections to surface real compromise signals that analysts can action quickly.
• Extend monitoring across endpoints and IoT assets Include edge devices, servers, and other distributed assets in continuous monitoring so tampering and execution changes are visible.
• Tie re-authentication to suspicious device behaviour Use device trust and conditional access triggers when location, posture, or access context changes unexpectedly.

Key takeaways

• The core problem is not the absence of security controls, but the delay between intrusion and recognition.
• The source cites benchmarks showing breach identification and containment still take far longer than most response models can tolerate.
• Improving signal quality, monitoring coverage, and investigation speed is the most direct way to shrink the attacker's usable window.

Related NHI Mgmt Group resources: Detection Engineering Guide · SOC Guide · Security Operations Metrics Guide · Compromise Assessment Guide

Key terms

• Dwell Time: Dwell time is the period between an attacker gaining access and defenders detecting or removing them. Shortening dwell time matters because most damage happens while the attacker remains unnoticed. In identity-led environments, reducing dwell time depends on visibility into access paths, privileges, and session behaviour.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Detection Engineering: The discipline of designing, testing, and maintaining detection logic so it remains useful against real attacker behaviour. It covers telemetry selection, rule quality, false-positive management, and the operational workflow needed to keep alerts actionable.
• Continuous Monitoring: Continuous Monitoring is the ongoing evaluation of access, activity, and control state rather than a periodic snapshot. In practice, it helps teams spot privilege drift, conflicting transactions, and configuration changes before they become audit findings or operational losses.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. Explore it when your programme needs a deeper operating model for identities, credentials, and access control.