Detection or Resilience? Where the Next Million Should Go
Every CISO eventually faces the same question: should we keep spending millions trying to detect every attack, or accept that breaches happen and focus on resilience?
AI has made this debate more urgent. Attackers can automate phishing, adapt their techniques and move faster through compromised environments. Meanwhile, SOC teams are drowning in alerts, and detecting an attack doesn't guarantee they'll stop it in time.
But does that mean detection is becoming less valuable?
Not at all. It means we need to rethink what we're paying for.
More tools don't necessarily mean better security
Many organisations already have plenty of security technology. Their problem isn't always visibility; it's turning that visibility into action.
An alert that arrives hours after an attacker compromises critical systems is useful for an investigation, but not much help in preventing the damage.
Equally, resilience alone isn't the answer. Backups and recovery plans won't tell you an attacker is inside or whether it's safe to restore your systems.
Assume breach is a sensible principle, but it shouldn't become an excuse to neglect prevention.
Invest in time, not just technology
The real question is simple: How long does an attacker need to cause serious damage, and how quickly can we stop them?
That should drive security investment.
Strengthen identity: Reduce the risk of compromised credentials and excessive privileges.
Improve detection: Focus on high-risk attacker behaviours rather than generating more alerts.
Automate response: Contain credible threats faster, with appropriate safeguards.
Test recovery: Prove that critical services can be restored from a clean state.
Limit the damage: Use segmentation and least privilege to prevent a small compromise becoming a business-wide crisis.
The right priorities depend on the organisation. Sometimes, better detection is the answer. Sometimes, fixing identity weaknesses will deliver far greater risk reduction.
The key is knowing the difference.
The verdict
Boards don't need another debate about security tools. They need to understand what could go wrong, how quickly the organisation could respond, and what the next million euros will change.
Don't choose between detecting an attack and surviving one. Build a strategy that does both.
AI is accelerating parts of the attack chain, making prevention, detection and response more interconnected than ever.
Ultimately, nobody on the board will ask how many alerts your SOC generated.
They'll ask how much damage the attacker caused, how quickly you stopped them, and how fast the business recovered.
That's what your security budget should be built around.
