Security is often described as a contest between attackers and defenders, and the contest has an unfair feature. A defender must protect every system, account and person, every day, while an attacker needs to find only one way in, once. This asymmetry means that perfect protection is not a realistic goal, however much is spent. That is not a counsel of despair. It is the starting point for sound strategy, which accepts that some attacks will succeed and designs to limit and recover from them. The risk in the other direction is complacency, where a clean audit or an impressive set of tools produces the belief that the organisation is secure. This commentary examines where defences are weakest and what a more honest approach looks like.
How well do defences resist advanced persistent threats?
Well-resourced attackers plan carefully, test their tools against common defences and move slowly to avoid detection. They may spend weeks or months in a network, using stolen credentials and legitimate administrative tools so that their activity resembles ordinary work. Preventive controls such as firewalls and endpoint protection will stop many of them and will miss some. What distinguishes mature organisations is how quickly they notice and respond. Dwell time, the period between compromise and detection, is a key measure, and reducing it requires comprehensive logging, analysis that looks for suspicious behaviour as well as known signatures, and practised procedures for investigation and containment.
Can traditional tools keep up?
Tools designed around known signatures and network boundaries struggle with modern conditions. Encrypted traffic hides content from inspection, applications live in cloud services outside the corporate network, and attackers use new techniques faster than signatures are written. Tools generate more alerts than staff can examine, so important signals are lost. Newer approaches, including behavioural analytics, identity-centric controls and automated response, help, but add complexity and require tuning. Tool sprawl is a hazard of its own, since every product adds an interface to manage and a potential gap between systems. Consolidating what is needed and ensuring that it is configured and monitored often delivers more than adding another product.
Cloud misconfiguration and human error
Many breaches begin with ordinary mistakes instead of sophisticated attacks. A storage bucket is left open to the internet, an access key is committed to a repository, a default password is never changed or an employee is deceived by a convincing message. Cloud platforms make it easy to create resources quickly and equally easy to expose them by accident, and the shared responsibility model leaves configuration with the customer. Human error cannot be eliminated by training alone, so effective programmes combine awareness with design. Phishing-resistant authentication, guard rails that prevent risky configurations, least privilege and automated scanning for exposed resources reduce reliance on every person getting every decision right.
Why it matters
Treating defences as incomplete leads to better decisions. Layered controls mean that one failure does not expose everything, assuming breach directs effort toward detection and containment, and rehearsed recovery limits the damage when an incident happens. Boards and executives should ask not whether the organisation is secure, which cannot be answered honestly, but how quickly it would notice an intrusion and how long it would take to restore normal operations. Honest measurement, including how quickly incidents are found and how long recovery takes, replaces comfort with evidence. The balance between protection and exposure is always fragile, and organisations that remember this are the ones that keep it.
A defence that has never been tested is an assumption. The strong ones have been proven by exercises, not by confidence.
