I spent the majority of my career on the defense side. SIEM, MDR, detection engineering, SOC operations. Programs at IBM and the companies that followed. I am proud of the curve we moved on response time and I know what good detection looks like.
But here is the part nobody says out loud. Detection and response is, by definition, reactive. We are responding to something that already happened. We have gotten faster, but a faster reaction is still a reaction. It does not beat an adversary moving at agent tempo.
What moved me was that realization. It is also the question every leader in security eventually must answer on their own terms. "Can we beat the adversary, or am I willing to accept the risk?"
Detection alone cannot answer that.
The Question That Actually Matters
The industry has spent five years asking how fast we can detect an intrusion. It is a fine question. It is not the right one.
The honest framing of a security program is the question in the title of this piece. Everything else is comfort.
Detection tells you the adversary arrived. Offensive security answers different questions: whether they will, where they will get in, where they will go next, and what you would do about it if they did. A leader who has only the first kind of information is operating partially blind.
Three Buckets: Fix, Mitigate, Accept
A good offensive program produces a ranked, evidenced list of exposures. Each one mapped to MITRE ATT&CK. Each one with a proof of concept. The offense does not do the triage. The leadership does. The offense produces the evidence that lets the triage be honest rather than aspirational.
Every finding ends up in one of three places.
Fix
Exploitable now. The blast radius is real. The path to closing it is in your control. Route to the asset owner with the proof of concept and the MITRE ATT&CK mapping. Track to closure on a clock shorter than your annual patch cycle.
Mitigate
The finding is real. The fix is not on the table this quarter. The system is legacy, the vendor controls the release cycle, the change window is locked, the EHR is the EHR.
Add a compensating control. A detection rule on the exact technique that just proved the exposure. A segmentation change that narrows the blast radius. An identity restriction. An MFA enforcement on the path the attacker would have taken.
Every mitigation is a tested attack pattern, which means it is detection content your SOC did not have before. The exposure remains. The cost of exploiting it is now higher, and the path to exploiting it now has a high-confidence detection sitting on it.
Accept
Some exposures are real and worth carrying. Acceptance is not surrender. It is a documented leadership decision. Dated. Owned by a named executive. With an explicit trigger that reopens the conversation: a vendor patch, a regulatory shift, a peer breach, or a new compensating control becoming feasible.
Without offensive evidence, “accept” is a euphemism for “didn’t think the risk was real.” With offensive evidence, “accept” is a position you can carry into a board meeting, a HIPAA audit, or a post-incident review and still hold your head up.
The bar is this: can you answer, in plain language, what would have to change for us to revisit this? If you can answer it, you have accepted a known risk. If you cannot, you are guessing.
What This Changes About the Budget Conversation
When a board asks, “Are we secure?” there is no honest answer. The question is unanswerable as posed.
When a board asks where we are beating the adversary, where we have compensated, where we have accepted residual risk, and whether the line is where we want it, those questions have answers.
Six Questions for Any Offensive Security Vendor
Three On Cost
1. What is the per-engagement compute envelope? And how is it capped? A program that runs continuously scales on compute the way SaaS scales on seats. If your vendor cannot answer this in numbers, they have not operationalized continuous testing yet.
2. What is the human-validation ratio? What percentage of program output reaches the customer without a human reviewer in/on the loop? The correct answer is zero. If the answer is anything else, ask the question again.
3. What is your one-operator coverage capacity? How many customer environments can a single human operator hold continuously? That number is the load-bearing economics of every continuous offensive testing program on the market.
Three On Guardrails
1. How is the fence scoped? What is the mechanism, and can the customer audit it in real time?
2. When does testing stop? How fast does it halt, and what does it leave behind when it stops?
3. What are the behavior budgets? What is each part of the system permitted to do, and what is structurally impossible for it to do, even with a misconfigured input?
If a vendor cannot answer those six in plain language without a slide deck, they do not have a continuous offensive program. They have a marketing motion.
The Takeaway
Don’t invest in AI-powered detection without technology-powered offense to match it.
The two outcomes are non-negotiable. You beat the adversary at their tempo. You answer, “Are we at risk?” in hours with evidence, not in weeks with a hypothesis.
That is the shift. It is the only way the math works against the adversary we have, in the budget cycle we are in.
