01

DETECT
The majority of operator time is spent looking for suspicious activities, with less than 5% detection rate after the first 20 minutes.
02

VERIFY
Around 10% of operator time is spent verifying security events – something humans are good at, when given enough time.
03

ACT
There is little time left for operators to actively collaborate on effective actions that prevent negative outcomes.