Wed Sep 09 2026
The bulletin landed in a mailbox nobody owned. The feed was technically integrated and operationally ignored. The alert reached a team of three who were already fighting something else. The signal existed; the route to a decision did not.
I have heard some version of this story from almost every security team I have worked with. And it is why, at CERTCON 2024, standing in front of CERT teams from across the Philippines, I made the claim I now make in every room: most organisations that get breached showed their exposure well in advance. The warning signs were there — visible, documented, sometimes literally reported — with enough time to act.
The warning existed. It just never arrived.
After two decades across networking, systems, and cybersecurity, I have watched the industry pour money into detecting more, faster, earlier. And it works. Feeds, sensors, information-sharing communities, national CERT bulletins — the raw material of early warning has never been richer.
Yet when I talk to the teams on the receiving end, the story is the same one I opened with. A warning only counts when it reaches someone who can act, in a form they can act on, while there is still time. That is what I mean when I say early warning is a delivery problem, not a detection problem.
When I came back for the 3rd CERTCON, my talk had shifted — from “Protecting businesses and citizens with early warning capabilities” to “Building & Strengthening CSIRT Capacity Through Early Warning”. The ordering matters. Early warning is not a product you buy and bolt on. It is a muscle you build into a team: who watches, who decides, who tells whom, and how fast that chain moves on a bad day.
The CSIRTs that do this well are not the ones with the most tooling. They are the ones that rehearsed the last mile — the phone call, the template, the authority to act at 2 a.m. — before they needed it.
So here is the question I now ask every leadership team, and it is worth asking yours: if a credible warning about your organisation arrived tonight, name the person who would read it, the decision they would be empowered to make, and the hour it would reach them.
If any part of that answer is “it depends” or “probably”, that is the gap. Not the feed. Not the platform. The last mile between a signal and a decision.
The good news is that the last mile is buildable. But it starts with admitting the warning was never the problem.
Views are my own. If I have gotten something wrong, tell me and I will fix the page.