The trace you would actually see (detection and the first hour)

One breach drawn as a row of jobs an attacker must finish in order, with the point where a single working defence would have stopped each one. Every one of those points is only a defence if somebody sees the attacker standing at it. This lesson is about the seeing.

Before you start. Anatomy of a Breach showed that a breach is a chain, that the defender only has to catch the attacker at one link, and that most real breaches ran for weeks before anyone noticed. Authentication showed credential stuffing: a thief takes passwords leaked from one site and tries each one, once, on another. This lesson asks the question both of those leave open: what would you actually have seen, and where?