🗺️ Fifteen years ago I helped bring in one of the first platforms that could take every log in a company, the firewalls and the servers and the badge readers and the mail gateway, and drop them all into one place you could finally search. Before it, an investigation meant logging into machines one at a time and hoping the evidence hadn’t already been overwritten. For its moment, it was close to magic.
What it really handed you was a board. A wall of clues you could pin and connect: a login from a country no employee had any business being in, a folder that quietly began archiving itself at three in the morning, a calendar with one bad week shaded red. You clicked each one, you drew the string between them, and the story of the attack slowly assembled itself in front of you.
That was the right tool for 2011. What surprises me is that someone will still try to sell it to you in 2026, barely changed.
Look closely at what that screen still takes for granted. That a person is sitting in front of it. That this person has the hours it takes to read the clues, the scars to know which ones matter, and the luxury of doing all of it after the attack is already over. Who is that person? When do they have those hours? And what is the intruder doing while they click?
We accepted this everywhere, for years. The analyst pulling an all-nighter to reconstruct a breach. The vendor questionnaire answered once and filed in a drawer. The dashboard that is only ever as fresh as the last time someone happened to look at it. All of it resting on the same quiet assumption: that there is a human with time.
There isn’t. There hasn’t been for a while.
People assume my years make me faster at reading that board. They don’t, and a junior with a good runbook out-clicks me most days. What the years actually left me is narrower and stranger: I know when that 3am archive is a backup job on one server, and when the very same pattern on another is the customer database walking out through a vendor’s tunnel. We have been spending that kind of judgment, the rare and expensive kind, on clicking through screens a machine should have read before anyone woke up.
The corkboard was never the problem. The problem is that we keep hiring people to stand in front of it, string in hand, long after the room has emptied and the attacker has driven home.