Cybersecurity Awareness Month serves as a great reminder that staying ahead of threats requires more than keeping up with the latest technology. As AI continues to change the threat landscape, it is worth taking a closer look at how we measure our ability to respond. And increasingly, we measure it in seconds.
Cybersecurity is obsessed with speed. We want faster detection, faster investigation and faster response times. Teams are constantly under pressure to identify threats before they spread and reduce the amount of time attackers have inside an environment.
There is some fairness to that urgency. AI is giving attackers new ways to move faster and make their activity harder to distinguish from legitimate behavior. But this focus on speed leaves out a key component of defense strategies–recovery and restoration. Many organizations can now detect an attack quickly (some in under 90 seconds) but still spend days dealing with its consequences
Detection is only the beginning
If a security team identifies an intrusion in 90 seconds but cannot restore affected systems or return critical operations to normal, the speed of detection loses value. Security teams have spent years building increasingly sophisticated layers of prevention and detection. Those investments remain important, but organizations must accept that eventually something will get through.
Attackers can use AI to create convincing social engineering campaigns and move through an environment quicker than ever before. At the same time, defenders can use AI to analyze alerts faster and automate parts of their triaging and response, but the same technology that helps a security team move faster does not eliminate the underlying risk.
That makes data trust an increasingly important part of security. Teams need confidence that the information they are using to make decisions is accurate, that they understand where critical data resides and that they can distinguish affected systems from those that remain trustworthy. When an incident occurs, teams need to know what was affected, what can still be trusted and how quickly critical systems can be brought back online.
Plans need to be pressure-tested
One of the biggest gaps I see in cybersecurity is the difference between having a plan and knowing that the plan works. Many organizations have incident response procedures documented somewhere, such as escalation paths, contact lists and technical processes. However, that is just a checklist.
Teams constantly have to make decisions with incomplete information, requiring complete coordination. That is why organizations need to regularly rehearse what happens during and after a serious incident.
Testing can reveal problems that are difficult to identify on paper. A recovery process might depend on someone who is unavailable, or a critical system might take much longer to restore than expected. A team may also realize it cannot determine which systems were affected quickly enough to make an informed decision. Finding those problems during an exercise is far better than discovering them during an actual attack.
This also changes how organizations should think about AI’s role in cybersecurity. Automating work that used to take an analyst an hour or identifying a threat in seconds instead of minutes is valuable, but we are quickly reaching a point where that should be expected from AI. The bigger question is what security teams can do with the time and information those capabilities give them.
To move with the times, security leaders should ask what those capabilities allow the organization to do: Does automation give analysts more time to investigate sophisticated threats? Does it help teams understand the scope of an incident? Does it improve decision-making when an attack is underway?
Those are harder questions, but they are more meaningful measures of whether AI is improving security. The goal should be to limit the damage when an attacker gets through and give the organization a clear path back to normal operations.
Prepare for the part nobody wants to happen
Cybersecurity Awareness Month is ultimately about building better security habits. Organizations should continue investing in prevention and detection, but they should also give equal attention to what happens when those defenses fail. That means testing response procedures, rehearsing difficult scenarios and making sure teams know how to operate when normal processes break down.
Gil Vega is Veeam’s Chief Information Security Officer, responsible for protecting Veeam’s information assets and helping customers secure critical data across environments while maintaining regulatory compliance. He brings more than 20 years of cybersecurity and risk management experience, including roles as CISO for CME Group, the U.S. Department of Energy, and U.S. Immigration & Customs Enforcement. Gil holds graduate and undergraduate degrees in Information Systems & Information Assurance and is a U.S. Army veteran.
