For most of the last two decades, security sat inside technology and reported upward in summary. That arrangement ended when disclosure timelines shortened and regulators began asking not whether an organisation was breached, but what it knew and when it knew it.
That is a different question, and it is answered by evidence rather than by posture.
Detection is not the constraint any more
Most enterprises detect. What they struggle with is the gap between detection and containment — the interval where an alert is real, understood by one engineer, and not yet acted upon because acting requires an approval that requires a meeting.
Closing that gap is an authority problem. Containment actions that are safe, reversible and well understood should not wait on a person; the ones that are not should never be automated. Deciding which is which, in advance and in writing, is the actual work.
What a board should ask
How long between deviation and containment, measured rather than estimated. Which containment actions execute without human approval, and who agreed that list. What evidence is retained for each automated action, and how quickly it can be produced under a disclosure obligation.
An organisation that can answer those three questions has a security programme. One that answers with a maturity score has a slide.
