I’ve always been drawn to investigative documentaries — the kind where detectives reconstruct an entire crime from fragments of evidence. The breakthrough never comes from a single clue. It comes from connecting everything: movements, relationships, timing, and intent. Miss one piece and the case stalls, or worse, you chase the wrong suspect.
Cybersecurity works the same way.
In one of my previous articles, I wrote that the Security Operations Center (SOC) struggles because of architecture, not headcount. We keep layering AI onto systems that were never designed to give it what it needs: complete, high-fidelity data. Without that foundation, even the most advanced model will fail to deliver on its promise.
What “complete data” actually means
For twenty-five years, “data” in security meant logs and events. But logs are a lossy representation of reality. Security products pre-filter and normalize telemetry before forwarding it, so the logs and alerts that reach the SIEM are roughly 10–20% of what the environment generated. A process-creation event arrives already stripped of its full context and its timing relationship to adjacent events.
The AI era raised the stakes. Modern AI-powered attacks now span multiple domains. Detecting and stitching them together requires complete, multi-product data.
Consider a departing employee who opens a competitive-analysis document, downloads it, uploads it to his or her personal cloud storage, and emails a copy externally. That attack chain spans four distinct systems. A traditional SIEM catches only isolated fragments — a DLP alert on the download, a CASB flag on the upload — but cannot reconstruct intent without the file’s lineage: what the document contained, who else had accessed it, how this user’s behavior compared to his or her six-month baseline. Analyzed through lineage and timeline, isolated anomalous activities can reveal an attack sequence in progress.