Predictable attacks, unpredictable defenses: why observability is the real security gap

Most cyberattacks don’t succeed because attackers are clever or innovative.

The vast majority are highly predictable, following the same well-worn paths of least resistance through their victims’ environments.

What remains unpredictable is not attacker behavior, but organizational defense.

Security strategies are often undermined by misconfigurations, excessive privileges, exposed services, and unmonitored connections between systems.

When enterprises are operating with unreliable defenses built on incomplete maps, even the most predictable attack comes as a surprise.

Why defenders are stuck with security maps they can’t read

It isn’t an exaggeration to say that threat actors often have a clearer picture of how systems connect than most security teams do.

Across hybrid and cloud computing environments, most organizations lack full visibility into how their applications, identities, devices, and workloads communicate. They can identify what exists but can’t reliably map how it all connects. That means they also can’t trace the paths an attacker would follow.

This lack of contextual visibility is reflected directly in the cyber risks driving most breaches. Our Containment Gap research found that IT vulnerabilities top the list of security concerns at 66%, with credential theft and privilege escalation close behind at 45%.

These are not sophisticated, hard-to-anticipate attack vectors, they are well-understood fundamentals. Meanwhile, the more unpredictable unknown of zero-day vulnerabilities ranks far lower at 23%.

So why are these known risks still driving most exposure, rather than advanced attack techniques?

In part, it’s a tooling problem. Legacy approaches like firewalls were never designed to provide application and network dependency mapping. That’s not the purpose of the telemetry they generate, so the result is a security strategy built around individual systems assessed in isolation. That means teams may secure each system effectively while remaining blind to how an attacker could move between them.

And of course, attackers actively exploit those boundaries. They target a weakness in one area to move toward what matters most. Without a connected view of the environment, defenders have no reliable way to anticipate those paths. The consequence is a growing disconnect between detection and action.

The growing gap between detection and containment

Even when security teams can see threat signals through their detection tools, they often lack the observability needed to understand why they matter. Establishing that context wastes valuable time, critically delaying the ability to respond.

Our research found that 95% of security professionals are confident they can detect unauthorized lateral movement, yet only 17% can isolate a compromised workload in near real-time. Most (51%) still take a few hours or longer to contain an incident.

This delay is critical. CrowdStrike found the average time to achieve lateral movement is now just 29 minutes. By the time most organizations are in a position to act, the attacker has already moved.

Even if an attacker breaches defenses and establishes persistence, they haven’t necessarily succeeded if they can be prevented from reaching critical data and systems.

However, the window for intervention is getting shorter. AI tools are enabling faster, more autonomous attacks. What previously required time, manual effort, and trial and error can now be executed at machine speed, with attackers quickly identifying the routes of least resistance and exploiting them in parallel.

Developments like Claude Mythos and GPT-5.5 are also increasing the ability for attackers to detect vulnerabilities at speed, develop targeted exploits, and chain these together – further accelerating the gap between detection and action.

This rapidly increasing asymmetry between attacker velocity and defender response is becoming the most alarming outcome due to the weaknesses in modern defense.

Rethinking the defense posture

As attackers increase their speed and precision with AI, traditional models built on prevention and detection alone cannot hold. Detection without the ability to act at speed simply extends the attacker’s window of opportunity.

Strengthening resilience requires a fundamental shift in how organizations think about stopping attacks once they’re inside. This shift has two fronts, and they are both essential.

The first is proactive containment. This starts by acknowledging that compromise is inevitable, and acting on that assumption before an incident occurs. It means understanding the level of risk in terms of connectivity and pathways and deciding whether that risk is acceptable.

If it isn’t, organizations should take steps to reduce risk. Remove unnecessary pathways, enforce boundaries between systems, and limit how far an attacker can travel before encountering resistance. The goal is to make the environment harder to navigate, not just harder to enter.

The second is reactive containment. When an incident does occur, how quickly you isolate determines the outcome. Proactive containment limits the attacker’s options while reactive isolation removes them completely. Architectural controls designed to reduce the blast radius of a breach must be treated as standard infrastructure, not something bolted on after the fact.

Neither approach alone is sufficient, and you need both working together to truly minimize the risk of a serious breach.

Observability as the foundation

Both proactive and reactive containment depend on the same prerequisite: a complete, accurate picture of how the environment connects and why.

That means moving beyond monitoring individual assets and building a true end-to-end view: one that maps how workloads, identities, and applications interact, and identifies the paths of least resistance an attacker would actually follow. You can’t segment what you can’t see, and you can’t isolate what you don’t understand.

This is where AI security graphs change the equation. By mapping dependencies across the entire environment in real time, they surface the routes attackers are most likely to exploit.

This visibility is grounded in actual system connectivity, rather than theoretical risk scores. That allows defenders to prioritize segmentation where it delivers the most protection, rather than securing assets in isolation and hoping the attacker takes a different path.

As attackers increasingly leverage AI to move faster and more precisely, this kind of systemic visibility matters more than ever. Graph-based security approaches level the playing field. They give defenders the same informed view of the environment that attackers have been quietly building for themselves, along with the speed to act on it before lateral movement becomes uncontrollable.

Predictable attacks only succeed in unpredictable environments. When the defenders can identify and close the visibility gap, the attackers lose their map.

We’ve reviewed, rated, and ranked the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit