Explain what makes an intrusion hard to see from inside.
Intrusions are often discovered months after they began. Why so late?
Yes.There is no alarm for someone signing in and reading files they are permitted to read. Detection means noticing that a normal action is unusual FOR THAT ACCOUNT, which is a much harder question.
Not quite.Many look constantly and collect enormous volumes of logs. Looking is not the same as being able to see this.
Not quite.Traces are usually there. They are indistinguishable from everybody else's traces without a baseline of what normal looks like.
Detection is not about spotting something bad. It is about noticing something ordinary happening in an unusual place, at an unusual time, by an unusual account.
Slide the volume of activity a security team must watch.
10,0005 million2 billion
Events to review10,000
A team can properly examine200
10,000A small organisation. A team can review the interesting ones by hand.
Alerts raised4,000
A team can properly examine200
5 millionA mid-size organisation. Only automated rules can touch this, and the rules produce their own flood.
Alerts raised20,000
A team can properly examine200
2 billionA large enterprise. Almost everything is filtered by systems nobody has time to audit.
The real intrusion is usually somewhere in those alerts. Why is it missed?
Yes.After an incident the evidence is nearly always found in logs that were collected at the time. Alert fatigue is not carelessness — it is the arithmetic of far more candidates than anyone can examine.
Not quite.It usually was. Post-incident reviews find it repeatedly.
Not quite.Twenty thousand alerts against a capacity of two hundred is not a skill problem.
Move the control to see what changes.
Which of these shorten the time to detection?
Knowing what normal looks like for each account.
Alerting on unusual access to the most sensitive data only.
Making it easy and safe for staff to report something odd.
Turning on every available alert rule.
Collecting more logs without deciding what to look for.
Yes.Detection improves by narrowing, not by collecting. The two noisy answers are the most common response to a missed incident, and they usually make the next one harder to see.
A team can properly examine 200 alerts a day and receives 20,000. What percentage can they examine?
%
Yes.One per cent. Whatever is in the other 99% is, for practical purposes, not being looked at — which is why tuning the rules matters more than adding them.
Put in order what this course says an organisation should do.
Tap them in order — first to last.
A password is not enough→Limit the reach→Know it and patch it→See it and recover
Four layers, in the order they pay.Yes.Roughly in order of how much risk each removes for the effort. Not one of them is about better encryption, and not one requires predicting what an attacker will do.
What is the honest summary of how organisations get breached?
Yes.It covers the credential, the persuaded employee, the accumulated permissions, the supplier's signed update and the missed alert. The technology is rarely defeated — it is used, correctly, by somebody who should not have it.
Not quite.Those exist and are reserved for a small number of high-value targets. They are not how most organisations are breached.
Not quite.A person clicking is one link, and the design that made one click sufficient is the failure worth fixing.
Lesson complete
Intrusions are missed because they look exactly like ordinary work.