Category: Decision Velocity


  • Detection is Not Enough

    As adversaries move laterally in seconds, detection alone isn’t enough. We must also optimize how fast we can decide. Recently, I wrote that IR must evolve from an episodic process to a continuous operating capability—because modern threats outpace traditional structures. Speed isn’t generated only in the SOC. It’s forged in governance. We’ve invested years in…

  • 27 Seconds

    27 seconds. That was the fastest observed breakout time for an intrusion in 2025. Not 27 minutes. Not 27 hours. 27 seconds.