The Order Matters: Why Containment Has to Come Before Detection

The SANS Mythos Report made one thing unmistakable for every Chief Information Security Officer: the threat landscape has structurally changed. AI has accelerated vulnerability discovery. Trusted-code supply chain attacks have become the dominant vector. The exploitation window has collapsed from weeks to hours.

What the report identifies correctly is that the industry must respond at an architectural level, not just an operational one.

What gets less attention is the sequence those architectural investments should be made in.

For two decades, the cybersecurity industry has run on a parallel-process model. Contain threats as best you can. Detect them quickly when containment fails. Respond fast when detection fires. All three happen at once, with detection as the load-bearing pillar. Mean time to detect became the defining metric because we assumed attacks would look different from legitimate activity, and the faster you could tell them apart, the smaller the damage.

That assumption has broken.

It has broken in the specific place Mythos identifies. When the attack is the expected behavior, when valid credentials are used, when signed packages carry the payload, when trusted code arrives through the same channels as legitimate code, there is no signal for detection to find. Eighty-two percent of current intrusions are malware-free. The attacker blends in. The detection stack sees nothing suspicious because nothing is suspicious, in the classical sense.

When that happens, the question that determines the outcome is no longer "did we see it." The question is "how far could it reach."

That is a containment question. And it has to be answered before the detection question, not in parallel with it.

The order is: contain, then detect, then eliminate.

Contain first means the architecture places limits on what any given workload can do, what it can reach, and what data it can access, before any detection system is asked to do anything. A compromised workload whose communication pathways have been governed in advance has a blast radius of one workload. A compromised workload whose communication pathways have not been governed has a blast radius of the entire network. That difference is decided by architecture, not by the speed of anyone's Security Operations Center.

Detect second, inside the governed space. Containment does not replace detection. It makes detection effective. By bounding what the attack can reach first, containment narrows the search space so the detection stack has fewer paths to analyze, fewer logs to correlate, and fewer false positives to triage. Detection works better when it is looking inside a smaller box.

Eliminate third, inside a bounded radius. When the compromise has been contained and detected, remediation can proceed without the pressure of an active lateral movement campaign. The incident is already not catastrophic. It becomes a defined problem with a defined scope.

Read in this order, every priority action in the Mythos Report takes on a slightly different shape. Egress filtering, segmentation, zero trust, least privilege, and the other architectural recommendations become not additional investments but the precondition for every other investment to pay off.

The sequence is not a preference. It is a consequence of the threat model the report itself describes. If the attack is indistinguishable from legitimate activity, then the only variable left to control is what it can reach. That is containment. And it is the first architectural question worth answering in the era Mythos has named.

Detection is not dead. Response is not dead. Both are necessary. But they are no longer sufficient, and they no longer come first.

Contain. Then detect. Then eliminate.

Everything else follows from the order.

Learn more about the Containment Era of cloud security.

Aviatrix will publish a deeper analysis of the Mythos Report on April 29.