Maintaining decision advantage in the digital domain is paramount as the cyber battlespace grows in significance and complexity. For the Department of War, a shift from reactive response to proactive defense is necessary to safeguard mission systems and military readiness. In today’s episode of the Modern Integrated Warfare podcast, Shawn Smagh, Principal Intelligence Liaison at GreyNoise, shares his perspective on driving mission impact with real-time edge intelligence.
Traditionally, the cyber community has relied on metrics like average time to detect and average time to respond to measure capabilities. Equally valuable, Smagh asserts, is decision time: the time between recognizing that an adversary is preparing an attack and the compromise itself. After a compromise has occurred, the options for remediation are limited. The ability to recognize indications and warning signs prior to compromise provides cyber teams with the operational flexibility to act before mission systems are damaged.
“[Decision time] is a new metric with which we can measure the value of threat intelligence, and intelligence is there to help reduce uncertainty,” Smagh said. “It represents a change from ‘How quickly did we respond?’ to ‘How early did we understand?’”