Detection coverage map
The attack routes that raise a signal, the ones that do not, and who sees each.
Who uses itSecurity operations, CISO
Solution 4 of 6
Detect, Respond & Recover
See an attack early, contain it fast, and restore the business with a plan that has been tested.
- 01Detect
- 02Respond
- 03Recover
- 14 daysglobal median dwell time in Mandiant’s 2025 investigations, up from 11 days the year before.Mandiant M-Trends 2026
- 22 secondsmedian time from initial access to hand-off to a second threat group in 2025. In 2022 it was more than 8 hours.Mandiant M-Trends 2026
- 48%of breaches involved ransomware in Verizon’s 2026 data, up from 44% the year before.Verizon DBIR 2026
- $1.93Mlower breach cost for organizations using security AI and automation extensively than for those using none.IBM Cost of a Data Breach 2026
The problem
The attacker moves faster than the queue.
Mandiant’s 2026 casework put median dwell time at 14 days, up from 11. The median gap between first access and hand-off to a second threat group fell from more than 8 hours in 2022 to 22 seconds in 2025. Verizon’s 2026 data show ransomware in 48% of breaches.
Most organizations measure detection by alerts reviewed. The attacker’s clock runs from first access, and in many intrusions the next step follows within minutes. What decides the outcome is who is on watch, what they can see, whether they are allowed to isolate a system without waiting for a meeting, and whether the backups restore.
IBM’s 2026 study found that organizations using security AI and automation extensively had breach costs $1.93 million lower than those using none.
Ransomware victims, Sophos 2026
- 2,158Organizations hit by ransomware in the past 12 monthsSophos 2026 survey, 17 countries. Every respondent had been a victim
- 56%Attacks that ended with data encryptedUp from 50% a year earlier. 41% were stopped before encryption
- 66%Encrypted cases restored from backupsUp from 54% in 2025
Sophos State of Ransomware 2026 surveyed 2,158 organizations that had all been hit, so the shares describe victims, not all organizations.
- 44% → 48%Ransomware share of breaches2025 report to 2026 report
- 43% → 52%Intrusions first detected by the victim itself2024 to 2025
How it works
How the work runs, step by step.
| Item | Signal raised | Seen by a person | Acted on in time |
|---|---|---|---|
| Stolen login used abroad | |||
| Exploited internet-facing server | |||
| Partner account used at night | |||
| Cloud key used from a new network | |||
| Backup deleted |
YesPartlyNo
We test what you would actually see if an attacker were inside. We follow the likely routes in, such as stolen logins, exploited systems and a trusted partner’s access, and check which of them produce a signal, who receives it and how fast they act. We look for the places where nobody is watching.
- We work from
- Log sources and detection rules, identity and endpoint telemetry, alert history, on-call and escalation arrangements, recent incidents.
- You get
- A detection coverage map by attack route, the gaps ranked by business impact, and a plan to close them.
- 0:00First signal reaches the on-call analystOn-call
- 0:20Decide whether to isolate the serverSecurity lead
- 1:00Call forensic retainer, preserve evidenceCISO
- 2:00Brief legal counsel and the executive teamCISO
- 4:00Decide on regulator and customer noticeLegal, CEO
We check who decides, who acts and who is told when something is found. We test the first hours: isolating systems, preserving evidence, calling in specialists, and informing the board, legal counsel and regulators. Evidence is kept intact so the cause can be proven later.
- We work from
- Incident response plan and contacts, authority to isolate systems, forensic readiness, communications plans, provider contracts.
- You get
- A tested response plan with named roles and decision rights, and a short list of changes made after each rehearsal.
- Payments2 days
- Customer portal1 days
- Order processing3 days
- Finance close4 days
- Email0.5 days
Tested restoreBusiness expects
We work back from the business services that must run first. For each, we test whether the data, the systems and the people exist to restore it, and how long it really takes. We check that backups are offline or otherwise out of an attacker’s reach, and that restores have been tried.
- We work from
- Business service priorities, backup and restore records, recovery objectives, dependencies between systems, past test results.
- You get
- A recovery order by business service, tested restore times against what the business expects, and the gaps between the two.
Where this starts
Start with the question you are stuck on.
Choose a question4 questions · select any
- Where we would start
- We trace the likely routes in and check which ones raise a signal, who receives it and how fast they act.
- Who works on it
- Detection and threat hunting practitioners, led by a senior consultant.
- What you hold at the end
- A coverage map by attack route, with the gaps ranked by business impact.
- Where we would start
- We review what it sees, what it misses and what happens after an alert, using your own recent alerts and incidents.
- Who works on it
- Security operations and detection engineering specialists.
- What you hold at the end
- A plain assessment of coverage, handling time and escalation, with fixes in order.
- Where we would start
- We run a realistic scenario with the people who would carry it: security, IT, legal, communications and executives.
- Who works on it
- Incident response and crisis management practitioners.
- What you hold at the end
- A short report of where decisions stalled, and a plan updated to match.
- Where we would start
- We start from the services the business cannot do without, and test whether they can be restored and how long it takes.
- Who works on it
- Cyber resilience and recovery specialists.
- What you hold at the end
- A recovery order by business service, with tested restore times next to the ones leadership expects.
What you hold
What you can use the week we finish.
| What the scenario exposed | Impact | Fix | Owner |
|---|---|---|---|
| Nobody could isolate the build server after hours | High | Name two people with authority | CISO |
| Backups reachable from the domain admin account | High | Move copies offline | IT ops |
| Legal learned of the incident after 6 hours | Medium | Add to first-hour call | Legal |
| Contact list had 3 outdated numbers | Medium | Quarterly check | Security |
Hours from first signal to containment
1from 9
Days to restore payments
2from 5
Routes with no detection
1from 4
Response plan and roles
Who decides, who acts and who communicates in the first hours, with authority written down.
Who uses itCISO, legal, communications
Exercise report
What a realistic scenario exposed, in plain language, with the fixes agreed.
Who uses itExecutive team, IT leads
Recovery order and test results
Business services in restore order, with tested restore times next to the expected ones.
Who uses itCIO, service owners
Measures
A short set tied to decisions, such as time from first signal to containment.
Who uses itCISO, board
A different way to look
The same security team, two ways to measure it.
4,012alerts this month
3,990closed
22unreviewed
| Alert | Severity | Status | Age |
|---|---|---|---|
| Impossible travel, user 482 | Medium | Closed | 2 h |
| Malware blocked, host 17 | Low | Closed | 3 h |
| Admin login, new device | High | Open | 19 h |
| Failed logins, VPN | Low | Closed | 1 d |
| Backup job removed | High | Open | 2 d |
| Port scan from internet | Low | Closed | 2 d |
- Unit of work
- An alert
- How it is measured
- Alerts reviewed and closed
- Who can act
- Whoever is on shift, after escalation
- What gets rehearsed
- Little, or only the plan on paper
- 09:12Signal: admin login from a new deviceDetected
- 09:31Analyst confirms and escalatesTriage
- 09:52Server isolated, evidence keptContained
- 11:20Executive team and counsel briefedDecided
- Day 2Payments restored from offline copyRestored
- Unit of work
- An incident, from first signal to restored service
- How it is measured
- Time from first signal to containment, and to restore
- Who can act
- Named people with agreed authority to isolate
- What gets rehearsed
- Decisions, communications and the restore itself
What leadership hears
We closed 4,000 alerts this month.→
The last drill was contained in 40 minutes. Payments restore takes two days.
Common mistakes
Beliefs worth dropping.
“We have MFA, so stolen logins are covered.”
Sophos’s 2026 survey found 79% of attacks started with an identity-based approach. Among victims whose root cause was compromised credentials, 97% had MFA enabled in some form. The report does not say how it was bypassed. The lesson is not that MFA is useless. It is one control, and someone still has to watch what happens after a login.
“We would have days to react.”
In the intrusions Mandiant measured, that hand-off took more than 8 hours in 2022 and 22 seconds in 2025. A hand-off does not occur in every intrusion. Where it does, a process that waits for office hours or for a meeting to approve an isolation starts the response late.
“We would know if someone were inside.”
Mandiant reports that organizations first found evidence of malicious activity internally in 52% of 2025 investigations, up from 43%. That is progress. It also means that in the rest, the first sign did not come from the victim’s own tooling. Whether your own team would see it first is something to test, not assume.
Regional view
What it means in the UAE.
The 2026 studies we used do not publish a UAE figure. Sophos surveyed organizations in 17 countries, including the UAE, but reports no UAE-specific results. We have not found a regional number we can verify, so we do not quote one. Attackers do not work to local business hours, so the useful benchmark is your own: how long from first signal to containment, and from containment to a restored service, measured in an exercise.
- 2024$2.73M
- 2025$1.53M
- 2026$1.70M
Mean cost to recover from a ransomware attack, excluding any ransom paid. Sophos State of Ransomware, by survey year.
Standards we work from
- NIST SP 800-61 Rev. 3NIST’s 2025 incident response recommendations, written as a Cybersecurity Framework 2.0 community profile. Our common language for response and recovery.
- ISO/IEC 27035-1:2023The principles and process for information security incident management: preparing for, detecting, reporting, assessing and responding to incidents.
- CISA #StopRansomware GuideA response checklist covering detection, reporting, containment and recovery. We use it as a reference for the first hours of a ransomware case.
Using a standard as a common language is not certification or endorsement.
Where our specialists come in
Specialist work, placed along the lifecycle.
Your problem decides which of these we use. You do not have to pick.
- Govern
- Identify
- Protect
- Detect
- Respond
- Recover
- Comply
- Evolve
Detect
Spot attacks early
- SOC / MDR
- SIEM Professional Services
- Threat Detection & Detection Engineering
- Threat Hunting
- Threat Intelligence
- Identity Threat Detection & Response (ITDR)
Respond
Contain and investigate
- Incident Response
- Digital Forensics & Incident Response (DFIR)
- Threat Investigation
- Ransomware Response
- Crisis Management
- Breach Response
- Identity Threat Response
Recover
Restore and improve
- Cyber Resilience
- Ransomware Recovery
- Security Remediation
- Recovery & Restoration
- Post-Incident Improvement
- Resilience Testing
Read first
What our practitioners have written on this.
Technical Explainer
After Authentication: What Should Security Monitor?
A completed sign-in proves little about what happens next. These are the signals that show an identity is being misused after it has passed the checks.
Cybrilliant Identity Security SME
Read →Technical Explainer
What Good Detection Engineering Looks Like
Treat each detection as a small product: a reason to exist, an owner, a test, a quality measure and an end date.
Cybrilliant Detection Engineering SME
Read →Executive Briefing
Cyber Resilience: What Happens When Preventive Controls Fail?
Prevention will eventually miss something. The leadership question is how long the business can run degraded, and how quickly it can return to a state it trusts.
Cybrilliant Cyber Resilience SME
Read →Practitioner Field Note
How to Test Security Remediation Before Calling Risk Closed
A ticket marked done proves that work happened, not that the exposure is gone. A repeatable way to tell the difference.
Cybrilliant Security Remediation SME
Read →Research / Report
Research: Detection Capability Maturity
Most detection maturity scores measure what a SOC has documented and deployed. This report looks at what published intrusion data says detection has to achieve, and what…
Cybrilliant SOC/MDR SME
Read →Expert Briefing
Expert Briefing: Detect, Respond and Recover From Identity-Led Attacks
Where identity-led attacks show up in your telemetry, which response steps remove an attacker who holds legitimate access, and how to prove your detection works.
Cybrilliant Identity Security SME
Read →Questions
What people ask before they start.
How is a managed detection service different from a SIEM?
A SIEM collects and correlates logs. It still needs rules, tuning and people to act on what it finds. A managed detection service supplies people who watch and respond, using tools. Either can fall short if coverage, authority to act, or escalation is unclear. We check those first.
Do you run our security operations center?
We start with the question of whether the one you have, in house or outsourced, would see and stop the attacks that matter to you. We review coverage, handling and escalation, and improve what is there. If a gap needs a provider or tool, we say so and agree it with you first.
What does a tabletop or resilience exercise involve?
A realistic scenario, played out by the people who would carry it: security, IT, legal, communications and executives. We record where decisions stalled and what was missing. CISA’s ransomware guide also recommends regularly exercising incident response and communications plans. The output is a short list of fixes.
Should we plan to pay a ransom?
That is a decision for your board, with legal counsel. We do not advise on it. We can help you reduce the need for it by testing restores. For context, Verizon’s 2026 data show 69% of ransomware victims did not pay. Sophos’s separate 2026 survey reports 48% paid to recover data.
Can we recover from backups alone?
Only if the backups are out of an attacker’s reach and a restore has been tried. CISA’s guide advises keeping offline, encrypted backups because many ransomware variants try to find and delete or encrypt accessible ones. Restore order and time are things we test, not assume.
Sources and notes
- Google Cloud / Mandiant, M-Trends 2026
- Verizon, 2026 Data Breach Investigations Report: Executive Summary
- IBM, Cost of a Data Breach Report 2026
- Sophos, The State of Ransomware 2026
- Sophos, The State of Ransomware 2026 (full report)
- CISA, #StopRansomware Guide
- NIST, SP 800-61 Rev. 3
- ISO, ISO/IEC 27035-1:2023