The Response Horizon

Ask a SOC manager when incident response begins and most will say: when something is detected. That answer is the reason so many security operations struggle.

By the time an alert fires, almost every decision that determines the outcome has already been made. Whether the right telemetry exists. Whether the detection was tuned for this environment. Whether a playbook exists for this asset. Whether anyone knows who can authorise isolating a production system at two in the morning.

Figure 2. The Response Horizon. Leverage falls and cost rises as the moment of impact approaches. The crossing point separates designing from reacting.

17.1 Two curves#

Leverage falls. A decision about which assets are critical, made during strategy work, shapes every detection rule and playbook that follows. The same question asked mid-incident buys almost nothing.

Cost rises. Designing telemetry coverage for an identity attack path is a planning exercise. Discovering during an intrusion that the logs were never enabled is a forensic dead end with regulatory consequences.

Most organisations live to the right of the crossing point and describe it as being busy.

17.2 Move decisions left#

For each recurring incident type, identify the decisions currently made under pressure and ask which could be made in advance. Containment authority. Isolation thresholds. Business impact tiers. Evidence preservation requirements. Every one moved left is minutes recovered and errors avoided.