Detection can confirm suspicious activity, but it rarely stops movement on its own. Once an attacker has valid access, every minute counts. Organisations need controls that constrain where that access can go, not just alerts that describe what already happened. Without containment, alerts may arrive after the attacker has already reached more sensitive systems.
Why detection is necessary but not sufficient after foothold
Detection is valuable because it exposes suspicious behaviour, but it does not itself prevent an intruder from using whatever access they already have. Once a foothold exists, the problem shifts from finding an event to constraining what the account, session, host, or token can still reach. For that reason, detection must be paired with containment, access reduction, and blast-radius limits. MITRE’s ATT&CK knowledge base is useful here because it maps the post-compromise behaviours defenders actually need to interrupt, rather than treating compromise as a single event. MITRE ATT&CK Enterprise Matrix
In practice, many security teams discover this gap only after an alert has already traced movement beyond the initial entry point.
What changes once an attacker is already inside
Before foothold, detection can still support prevention by surfacing phishing, brute force, malware delivery, or suspicious authentication patterns. After foothold, however, the attacker’s advantage changes. They may already possess a valid session, a machine token, a remote management path, or credentials that look legitimate to downstream systems. At that stage, alerts can tell you where the intrusion is moving, but they cannot by themselves revoke trust, halt lateral movement, or stop data access.
The practical question becomes whether the environment has controls that limit what the attacker can do with the access they gained. Segmentation, least privilege, just-in-time elevation, session controls, rapid credential invalidation, and isolation of sensitive systems all matter because they reduce the amount of ground an intruder can cover before response begins. A detection program without those constraints often becomes a reporting layer for an incident that is already spreading.
- Detection answers “what is happening?”
- Containment answers “what can this actor still reach?”
- Privilege reduction answers “what should this access never have been able to do?”
That distinction matters because post-breach timing is usually asymmetric: defenders need to be correct quickly, while attackers only need one path to remain usable. NIST’s Cybersecurity Framework is relevant here because it treats detection, response, and recovery as connected functions rather than isolated activities. NIST Cybersecurity Framework 2.0
Where this guidance breaks down is in environments that have no meaningful trust boundaries or no practical way to revoke access once it is issued.
Where detection-only thinking breaks down
Tighter visibility often increases operational noise, requiring organisations to balance faster alerting against the risk of assuming alerts equal control. Some teams also overestimate the value of high-fidelity detection when the underlying identity or network design still permits broad movement. If an attacker can reuse the same credentials across systems, reach sensitive services from a compromised workstation, or keep a session alive after compromise, the detection stack may simply document the breach in more detail.
There is also a common consensus gap around “time to detect” versus “time to contain.” The first metric describes how quickly the team sees trouble; the second describes whether the environment can actually be protected after the alert fires. In many real incidents, the second metric is the one that determines damage. That is why detection should be treated as one layer in a larger containment architecture, not as the end state of security operations.
For organisations building mature response capability, it is also useful to align alerting with response authority: who can disable accounts, isolate hosts, cut sessions, or revoke tokens immediately when the signal is credible. Without that authority, detection remains informational even when the risk is clearly actionable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0008 — Lateral Movement | Post-foothold movement is the core problem detection must interrupt. |
| TA0005 — Defense Evasion | Attackers often use valid access and stealth to keep operating after detection starts. | |
| Recommendation — Map post-compromise activity to TA0008 and block paths that let an intruder move beyond the first host. Hunt for evasion patterns that let valid access survive long enough to expand the breach. | ||
| NIST CSF 2.0 | DE.AE — Anomalies and Events are Detected | Detection is necessary, but this function alone does not contain a live intrusion. |
| RS.MI — Mitigation | The question centres on why alerts must lead to active mitigation after foothold. | |
| PR.AC — Identity Management, Authentication, and Access Control | Valid access is the foothold that detection must be complemented by access constraints against. | |
| Recommendation — Use DE.AE to surface suspicious activity, then pair it with containment actions that limit spread. Trigger RS.MI actions that isolate affected assets and reduce attacker reach after detection. Apply PR.AC controls to restrict what compromised credentials, sessions, or tokens can access. | ||
| CIS Controls v8 | 6 — Access Control Management | Least privilege and rapid revocation directly reduce post-compromise reach. |
| Recommendation — Use Control 6 to limit standing access and revoke paths an attacker could reuse after entry. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
