Here is a question the security industry does not ask itself often enough. Billions have been poured into detection capability, AI-driven tooling and managed security operations over the last decade, thousands of analysts working round the clock, watching dashboards, chasing alerts. Yet the threat is getting worse, not better. So, at what point do we stop adding to the pile and ask whether we are solving the right problem?
My honest view is that we are not, and the numbers bear that out.
The model we have built is reactive by design. It measures what happens after the threat is already inside your environment. It does not ask whether it was preventable, and for most midmarket organizations that is the question that matters. For a business with a lean IT team, the detect-and-respond model is not really a strategy. It is a way of staying one step behind something that moves faster than you can.
Think about what 12 days means in practice. That is the average attacker dwell time before detection, according to the Microsoft Digital Defence Report 2025, and for organizations without continuous monitoring the window is considerably longer. When an attacker gets in, they do not announce themselves. They come in and pause, asking the same question you should be asking: have I been detected?
Once satisfied the answer is no, they start laterally moving. Across file stores, from system to system, working toward the information and assets that matter. Admin credentials. Payroll access. The exec-level permissions that authorize high value transactions. By the time something flags, they have already done their reconnaissance.
The Identity Challenge
What makes this harder is identity, and it is the thing midmarket businesses rarely get the chance to address properly. There is no point monitoring a thousand accounts if you have not first worked out which of those are the top priority.
In most organizations the number of accounts with elevated or admin-level privileges is far higher than it needs to be. Service accounts set up years ago and rarely reviewed. Global admin rights assigned because it was easier than scoping access correctly. Former employees never fully deprovisioned. An attacker who reaches any one of those accounts does not need to be sophisticated. The access is already waiting. The instinct therefore is to monitor everything, which in practice means a higher probability of missing something critical.
The noise problem makes it worse. A significant portion of what security teams deal with daily is not an attack at all; it is a policy gap presenting as a threat. Controls that exist on paper but are not enforced in the system generate unnecessary alerts, and with businesses reporting a cybersecurity skills gap, the person looking at those alerts is often competent and stretched, but possibly not a trained threat analyst. The whack-a-mole problem is not just that the moles keep popping up. It is that you cannot always tell which ones to tackle first
The UK retailer attacks last year made this evidence. The attackers did not find a zero-day exploit. They rang the IT help desk, impersonated an employee and asked for a password reset, and that single interaction became the entry point for one of the most disruptive and costly string of cyberattacks in UK retail history. A clearer picture of which accounts were high value, and tighter controls on what those accounts could authorize, might have been flagged earlier.
The Importance of Focus on Risk
The reframe I keep coming back to is straightforward. Instead of putting all emphasis on running a security operation, we need to focus more on the risk operation. There are a million ways to attack an organization but a finite number of reasons why. Although threat actors are motivated by different things, the requirement to be able to gain access, and exfiltrate something of perceived value is consistent. They have a rough sense of what they want before they arrive, and they go straight for it
If you could only lock one thing from your company in a safe, what would it be? Start there. Look at which people and accounts hold the digital keys to it, when they were last used and whether every person on that list still needs access. Then ask what your response looks like if one of those accounts is compromised. Not in theory. Who gets called, what gets isolated, what gets communicated to stakeholders and when. If you cannot answer that cleanly, your security posture has a gap.
That conversation should also happen at board level, not just inside the IT function. What is this data worth to us? What does it cost if it is exposed, not just in fines and recovery but in stakeholder relationships and the ability to trade? Those are the questions that move security from a line in the IT budget to a decision that belongs at the top of the organization
The midmarket is not unsophisticated. It is stretched. The answer is not to simply replicate what a large enterprise security operation does. It is to be more deliberate in the strategy: know the criticality and priority of what you are protecting, understand the realistic threat to it, and make sure the people know what to do when they get a call at midnight on a Friday, and are fully prepared.