How cyber defense shifted from signatures to detection and response

At a glance

What this is: This history of cyber security traces how defender models evolved from antivirus signatures to endpoint detection, response, and supply chain awareness as attacks became faster, stealthier, and more disruptive.

Why it matters: It matters to IAM practitioners because the same shift from static prevention to runtime visibility applies to NHI, service accounts, and privileged access that attackers can abuse in minutes, not days.

By the numbers:

• From a few tens of thousands of known samples in the early 90s, the figure reached around 5 million new samples every year by 2007.
• By 2014, it was estimated that around 500,000 unique malware samples were being produced every day.
• Within 24 hours, WannaCry had infected more than 230,000 computers in over 150 countries.

👉 Read SentinelOne's history of cyber security from worms to ransomware

Context

Cyber defense moved from blocking known binaries to understanding attacker behaviour because the volume and variety of threats outgrew signature-based control. That shift matters in identity programmes too, where service accounts, API keys, tokens, and privileged sessions can be abused long after a point-in-time check has passed.

The article uses major milestones such as Morris, EternalBlue, WannaCry, and SolarWinds to show that the real control problem is not just malware prevention but visibility, containment, and response. For IAM teams, the parallel is clear: when credentials, access paths, or delegated trust are abused at machine speed, governance must be continuous rather than episodic.

Key questions

Q: What breaks when security teams rely on signatures to stop modern malware?

A: Signature-only defense breaks when attackers reuse trusted tools, mutate code, or switch to fileless execution. The control can still catch known samples, but it cannot keep up with sample volume, protocol abuse, or attacks that complete before the next signature update. Teams need behavioural detection and containment, not just file matching.

Q: Why do lateral movement attacks matter more once an attacker gets inside?

A: Lateral movement turns a single foothold into a platform for broad compromise. Once an attacker can use internal protocols, remote commands, or reused trust relationships, the environment itself becomes the attack surface. That is why east-west visibility, segmentation, and privilege restriction are critical once perimeter controls fail.

Q: How do security teams know whether detection and response are actually working?

A: They should measure how quickly suspicious activity is identified, contained, and investigated across endpoints, identity systems, and network paths. Useful signals include dwell time, time to isolation, and whether the team can correlate process execution with access changes before impact occurs. If those signals are missing, the programme is still relying on prevention assumptions.

Q: Who is accountable when ransomware reaches sensitive systems despite existing controls?

A: Accountability sits with the organisation's control owners, not with any single tool category. Security leaders should map responsibility across identity, endpoint, network, backup, and incident response functions, because ransomware succeeds when those controls are not orchestrated together. Frameworks such as NIST CSF and NIST SP 800-53 are useful for assigning that ownership.

Technical breakdown

Why signature-based antivirus stopped scaling

Early antivirus products matched files against signatures, usually hashes or known strings associated with malware. That worked when the threat volume was limited and attackers reused code, but it broke down as malware families diversified and daily sample counts exploded. Signature logic also struggled with false positives and high resource consumption, which made it expensive to run and hard to trust operationally. The practical result was a control that could identify known patterns but not reliably keep pace with new ones.

Practical implication: shift from static detection to runtime telemetry and behavioural controls that can see unknown or modified threats.

How lateral movement bypasses perimeter assumptions

Lateral movement is the act of using an initial foothold to issue commands, run code, and spread across connected systems. EternalBlue showed why this matters: a flaw in SMB, the Windows file sharing protocol, gave attackers a stealthy way to move through environments without needing a fresh phishing event for every host. This is why endpoint controls alone are not enough when protocols, trust relationships, and service exposure create internal pathways for abuse.

Practical implication: reduce internal trust zones and monitor east-west activity for abnormal command execution and protocol abuse.

Why ransomware changed the defender's job

Ransomware evolved from simple encryption into a combined extortion model that steals data first and then threatens disclosure. That changes the failure mode for defenders, because backups alone no longer neutralize the attack if confidential data has already been copied. The article also shows that fileless techniques, PowerShell abuse, macros, and social engineering reduce the value of signature-based blocking. The control challenge becomes fast detection, containment, and recovery before the attacker completes their objective.

Practical implication: build response workflows around rapid isolation, identity revocation, and data exposure assessment, not only backup restoration.

Threat narrative

Attacker objective: The attacker wants durable internal access that can be turned into disruption, theft, or broad compromise before defenders can respond.

1. Entry begins with a known vulnerability, malicious attachment, or trusted supply chain component that lets the attacker execute code inside the environment.
2. Escalation follows through lateral movement, fileless execution, or abuse of weak internal trust so the attacker can reach additional systems and privileges.
3. Impact arrives as ransomware, data theft, or supply chain compromise that disrupts operations and undermines confidence in the environment.

NHI Mgmt Group analysis

Static prevention is no longer a sufficient governance model: this article shows that the defender's centre of gravity moved from blocking known files to observing behaviour across the runtime. Malware volume, fileless execution, and internal lateral movement all erode the value of point-in-time controls. For identity programmes, the same lesson applies to service accounts and tokens: if access is only reviewed periodically, it will be abused between reviews.

Detection latency is now a governance metric, not just an operations metric: the article's emphasis on dwell time captures a deeper truth. If attackers can execute, propagate, and clean up in seconds or minutes, then slow review cycles and fragmented telemetry leave a structural gap. This is why modern control design has to connect identity, endpoint, and network signals into one response path.

Runtime trust, not asset ownership, is the named concept this history exposes: defenders repeatedly assumed that internal systems, protocols, or signed artefacts were safe enough to trust until proven otherwise. EternalBlue, WannaCry, and SolarWinds all show how that assumption fails under active adversary pressure. The practitioner conclusion is to treat every trusted path as revocable and continuously monitored.

Ransomware changed the meaning of resilience by combining encryption with extortion: once attackers began stealing data before encryption, backup strategy alone stopped being a complete answer. The article reflects a broader shift in which response quality depends on identity containment, access revocation, and exposure assessment as much as recovery tooling. Organisations should measure resilience as the ability to contain identity abuse before it becomes business impact.

What this signals

Runtime observability is the control theme that now spans endpoint, identity, and resilience programmes. The article's history of malware makes one point clear: attackers win when defenders cannot see the execution path soon enough to intervene. For identity teams, that means service-account activity, token use, and privileged session changes need the same operational attention as process telemetry, with NIST SP 800-207 Zero Trust Architecture as the baseline assumption model.

Standing trust is becoming the weakest part of the control stack. Whether the trust is an internal protocol, a signed package, or a long-lived credential, it becomes a liability the moment an attacker can reuse it without re-verification. Organisations should expect their NHI and privileged access programmes to converge with endpoint and supply chain monitoring, because the attack path no longer respects domain boundaries.

Detection-response latency is the practical limit on resilience. If an environment cannot isolate an endpoint, revoke access, and validate exposure before the attacker finishes the chain, then the programme is still depending on prevention that may already have failed. The governance question is no longer whether attackers can enter, but how quickly the organisation can collapse the trust they are abusing.

For practitioners

• Harden internal movement paths Map the internal services and protocols that allow command execution or remote file access, then reduce exposure with segmentation, allow-listing, and protocol monitoring. Prioritise SMB, PowerShell remoting, and other high-abuse pathways that attackers can use after initial access.
• Instrument detection around runtime behaviour Collect endpoint and identity telemetry that shows execution chains, privilege changes, and abnormal parent-child process behaviour. Detection should focus on what a user, service, or process did rather than whether a file matched a known signature.
• Treat supply chain trust as revocable Assume that signed updates, vendor tooling, and build-system dependencies can become attacker-controlled. Add integrity checks, provenance validation, and post-update monitoring so that trusted distribution paths are not treated as permanently safe.
• Link recovery to identity containment When ransomware or destructive malware is suspected, isolate endpoints and revoke credentials, tokens, and privileged sessions before the attacker can reuse them. Recovery plans should include access rollback as well as backup restoration.

Key takeaways

• Cyber defense moved from signature matching to runtime detection because malware volume and attack variety outpaced static prevention.
• The same attacker patterns that made worms, ransomware, and supply chain compromise effective also expose the limits of standing trust in identity and access.
• Security programmes need faster detection, tighter segmentation, and identity containment to stop attacks before they become operational disruption.

Key terms

• Signature-based Antivirus: A detection approach that compares files or code fragments against a database of known malicious patterns. It can be useful for known threats, but it struggles when attackers mutate payloads, use trusted tools, or execute without dropping obvious files.
• Lateral Movement: The phase of an intrusion where an attacker uses an initial foothold to reach additional systems, accounts, or services. It typically relies on internal trust, remote execution, credential reuse, or protocol abuse to expand access without needing a new entry point.
• Fileless Malware: Malicious activity that uses built-in tools, scripts, or memory-resident execution rather than dropping a traditional executable. This makes it harder for legacy antivirus to detect because the behaviour may look like normal administration unless runtime telemetry is in place.
• Detection and Response: A security operating model focused on finding suspicious behaviour quickly and containing it before the attacker can complete their objective. It depends on visibility, correlation, and action speed across endpoints, identities, and network paths, not just on prevention controls.

What's in the full article

SentinelOne's full analysis covers the operational detail this post intentionally leaves for the source:

• Historical attack timelines for Morris, EternalBlue, WannaCry, and SolarWinds that show how tactics evolved over time
• Product and solution context around endpoint protection and detection tooling that this post did not evaluate
• Examples of how adversaries used fileless malware, macros, and PowerShell to bypass legacy controls
• The vendor's own demonstrations and product tour content on visibility, forensics, and rapid recovery

👉 The full SentinelOne article traces the attack eras, technical transitions, and product context in more detail.

Deepen your knowledge

NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, workload identity, and agentic AI identity. It is designed for practitioners who need to connect identity control with broader security operations and risk decisions.