Topic starter
11/11/2026 6:01 pm
TL;DR: Cybersecurity teams still struggle to detect and contain intrusions fast enough, according to Crytica Security, as IBM-cited benchmarks in the source show average breach identification and containment times remain measured in days, not minutes. Detection has become the control that determines whether response can still matter.
Editorial analysis by NHI Mgmt Group, based on content published by Crytica Security: “Theme to Watch in 2023: Cybersecurity and Closing the Detection Gap”.
By the numbers:
- The average time to identify and contain a data breach was 277 days, according to IBM's 2022 Cost of a Data Breach research cited by Crytica Security.
- The average cost of a data breach was $4.35 million USD, according to IBM's 2022 Cost of a Data Breach research cited by Crytica Security.
Key questions
Q: Why does poor detection make zero trust less effective?
A: Zero trust relies on continuous verification, so weak detection leaves attackers free to move after the first control passes.
Q: How does continuous monitoring improve endpoint security?
A: Continuous monitoring improves endpoint security by collecting ongoing telemetry from processes, logins, network connections, file changes and security controls on each device.
Q: How do security teams reduce attacker dwell time during Windows incidents?
A: Teams reduce dwell time by combining real-time runtime detections with fast asset discovery and a unified alert workflow.
Practitioner guidance
- Measure dwell time as a core security KPI Track time to detect, investigate, and contain separately so leadership can see where response actually stalls.
- Prioritise high-fidelity detections over alert volume Reduce low-value alerts and tune detections to surface real compromise signals that analysts can action quickly.
- Extend monitoring across endpoints and IoT assets Include edge devices, servers, and other distributed assets in continuous monitoring so tampering and execution changes are visible.
Bottom line: The core problem is not the absence of security controls, but the delay between intrusion and recognition.
Glossary terms: Dwell Time, Zero Trust, Detection Engineering, Continuous Monitoring
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Detection latency is now a governance problem, not just a tooling problem. When organisations optimise only for prevention, they leave a long window in which attackers can operate before any response begins. That window drives cost, staffing pressure, and poor board visibility into real resilience. Practitioners should measure detection as a first-class control outcome, not as a side effect of logging.
A few things that frame the scale:
- Breaches involving stolen or compromised credentials take an average of 292 days to identify and remediate, according to IBM’s Cost of a Data Breach.
A question worth separating out:
Q: What is the difference between detection and response in security operations?
A: Detection identifies and contextualises suspicious activity, while response contains, remediates, and coordinates action across tools and teams. In practice, SIEM supports the first function and SOAR supports the second, and mature programmes need both to avoid either blind spots or slow containment.
👉 Read our full editorial: Detection gaps keep breach response too slow for cyber resilience