How great security teams turn threat detection into protection

A modern security operation can process billions of security events, but its effectiveness ultimately depends on whether analysts can connect the right pieces quickly enough to understand an attack and influence its outcome.

That means identifying which observations belong together, recognising when new evidence changes the significance of something seen earlier, and establishing how far an attacker has reached while there is still time to contain the activity.

This has consequences for how security operations are designed and where organisations invest.

The evidence available to analysts, the detections that direct their attention, the expertise they bring to an investigation and the processes that allow them to respond all affect how quickly an organisation can understand and contain an attack.

A phishing attack hidden in legitimate activity

Consider a recent device code phishing attempt the Kocho team recently investigated.

It began with an apparently normal email conversation. The attacker used legitimate infrastructure, spent time establishing trust and eventually directed the user to a genuine Microsoft sign-in page to enter a device code.

There was little in the email conversation itself to expose what was happening. The evidence that changed the investigation appeared in the identity layer, where an unusual device code sign-in triggered a detection. The security team could then revoke the relevant sessions and tokens before the attacker used the access.

The email exchange seemed ordinary until the unusual sign-in gave analysts a reason to look again. Connecting the two helped them understand how the attack had unfolded.

Investigations often develop in this way.

New information can extend the sequence, narrow the possibilities or change the significance of something seen earlier. Analysts continually revise their understanding as evidence accumulates, which is why visibility across identity, endpoints, email, cloud applications, networks and SaaS platforms has to work as more than a collection of separate monitoring capabilities.

An analyst needs to be able to follow the evidence as the investigation develops.

Choosing which data to collect

Not all security data needs continuous monitoring. Different sources serve different purposes:

• Some contribute directly to detection
• Others are mainly useful during an investigation
• Some need to be retained for compliance

Firewall logs, for example, can generate large volumes without always adding enough to live detection to justify continuous ingestion.

MITRE ATT&CK helps teams identify the behaviours they need to recognise and the evidence required.

This helps them assess what each data source contributes, what they might miss without it and whether its cost is justified.

Giving analysts more of the picture

Huge amounts of investigative time can be spent gathering the information surrounding an alert. An analyst may need to establish what else a user has done, what happened on a device, which applications were involved, what threat intelligence is relevant and in what order events occurred.

This is where AI is beginning to change how analysts work. It can bring together context from multiple sources, summarise activity, construct timelines and help identify information that warrants closer examination. In threat hunting, it can translate a question expressed in natural language into a query that an analyst can review and run.

Work that previously required an analyst to move between systems and assemble information manually can increasingly be done much faster.

That changes where the analyst can spend their time. Earlier access to relevant context gives them more opportunity to:

• Investigate what the evidence means
• Test different explanations
• Determine the appropriate response

AI can accelerate the work around those decisions, but the quality of the investigation still depends on the analyst understanding the environment and judging whether the apparent relationships within the evidence make sense.

Used well, it gives analysts more capacity for precisely the work where their expertise matters most.

Turning understanding into action

Once an analyst understands what’s happening, the value of that work depends on how quickly the security team can respond.

That requires decisions to be made before an incident occurs. If an account appears compromised overnight, the team needs to know whether it can revoke sessions immediately. Known responses can often be automated, while more ambiguous situations require an analyst to establish the scope and appropriate action.

Response processes therefore matter alongside visibility, detection and expertise. They determine how quickly an understanding of an attack can become containment.

What the evidence allows us to conclude

The phishing case shows these capabilities working together. Identity telemetry exposed activity the email layer could not. Detection brought it to an analyst’s attention, the analyst connected it to the earlier conversation, and the security team could revoke access before it was used.

Where that chain becomes weaker can reveal gaps in visibility, detection coverage, analyst capacity or expertise, or the processes needed to respond quickly.

Addressing them means looking at the security operation as a whole, including whether the organisation has the resources and specialist capabilities to sustain them.

If you’re actively exploring how to get the best from your security operations, check out my latest webinar, Taking Security Operations to the next level.

I explore where AI can help, where human expertise matters, and what to consider when choosing between in-house operations and specialist support.