Topic starter
02/08/2026 11:42 am
TL;DR: Only 12% of security leaders validated EDR effectiveness in the last three months, while 26% test whether the SOC can detect and interrupt real attack techniques, according to Horizons.ai. Security controls need proof of interruption, or completion metrics can mask exposed attack paths.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “The State of Assumed Security”.
By the numbers:
- 93% of CISOs believe they have taken the right steps to prevent a breach.
- Only 12% have validated EDR effectiveness in the last three months.
- 11% confirm or remediate known exploited vulnerabilities within 24 hours.
Key questions
Q: Why do unvalidated controls create more risk in identity-driven environments?
A: Identity-driven environments allow attackers to move through access, privilege, and trust relationships instead of exploiting only one system.
Q: How can security teams tell whether EDR and SOC controls are actually working?
A: They should test whether those controls can detect and interrupt real techniques, not just whether alerts are generated or dashboards look healthy.
Q: What breaks when security teams rely on dashboard completion instead of validation?
A: Completion metrics can show that tasks were done without proving that controls stop an attacker.
Practitioner guidance
- Implement attack-path validation as a control objective Test whether a realistic chain from entry to lateral movement still exists after remediation, rather than closing issues because individual findings were marked complete.
- Measure EDR and SOC resistance against real techniques Run validation exercises that check whether endpoint and SOC controls can detect, interrupt, and contain the techniques attackers actually use, not just alerts and policy states.
- Prioritise known exploited vulnerabilities by exploitability, not queue age Confirm or remediate known exploited vulnerabilities quickly, and verify that the exploit path is actually removed instead of relying on scan-only closure.
Bottom line: Assumed security breaks down when organisations confuse completed remediation with proven resistance to attack.
Glossary terms: Security Validation, Attack path, Exploitability context, Control Effectiveness
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
02/08/2026 12:53 pm
Assumed security is a measurement failure, not a tooling failure. When organisations reward completed work, they can mistake administrative closure for adversary resistance. The report’s numbers show that confidence is far ahead of proof, which means the governance gap sits in the way resilience is measured. Practitioners should treat verification as the control objective, not the after-action report.
A question worth separating out:
Q: Should organisations prioritise attack-path testing before expanding more controls?
A: Yes, when they already have broad tooling but weak proof of effectiveness. Attack-path testing reveals which controls actually interrupt adversary movement and which only report coverage. That helps security teams invest in the weakest link first, especially where identity paths or privilege chains remain open.
👉 Read our full editorial: Assumed security is failing: why verification now matters