Prevention, Detection, Response

Every control in security does one of three jobs, and a useful habit is naming which one. Prevention is the locks: firewalls dropping hostile traffic, MFA refusing a stolen password, patches closing the window before anyone climbs through. Prevention is the cheapest place to win, because a blocked attack costs nothing to clean up.

But locks fail — and a city with only locks discovers burglaries weeks later, by accident. Detection is the alarm system and the night watch: endpoint agents flagging suspicious behavior, log correlation noticing a login from two countries an hour apart, an analyst spotting traffic that does not belong. Detection exists because of assume breach: whatever prevention misses must be seen, and seen quickly.

An alarm nobody answers is just noise. Response is the fire brigade: isolating the infected machine, locking the compromised account, restoring from backups, and following a playbook written calmly before the emergency rather than improvised during it. Response speed is where dwell time gets cut from weeks to minutes.

This is also the lens for understanding managed security. Most organizations can buy locks. Far fewer can staff a watch that never sleeps and a brigade that answers at 3 a.m. — which is exactly the gap a 24/7 SOC like Vijilan's fills: continuous detection and immediate response layered on top of whatever prevention is in place. When you evaluate any security posture, ask the three questions in order: what stops attacks? what notices the ones that get through? who acts, and how fast?