Why Cybersecurity Needs Machine-Speed Response
My perspective on cybersecurity has been shaped above all by observing what actually happens inside networks. Over time, I realized that one of the biggest problems is not the lack of security tools, but the gap between the moment an anomaly emerges, the moment it is understood and the moment someone can actually take action.
Modern infrastructures are simply too dynamic and heterogeneous for every security decision to depend on manual intervention. That has strongly influenced our approach: continuously observing network behavior, correlating different signals and enabling the system to respond autonomously whenever the context and level of confidence make that appropriate.
For me, however, autonomy does not mean removing people from the process. It means moving human oversight to a higher level. People define policies, thresholds, operational context and permitted response levels, while technology executes decisions that can be made reliably and repeatedly at machine speed.
This is also one of the principles behind LECS: reducing the time between detection and response, particularly when a threat starts moving laterally across the network.
Bridging Network Visibility Gaps
The biggest challenge is visibility.
An enterprise network is no longer made up only of workstations and servers. IT systems now coexist with industrial equipment, IoT and IoMT devices, embedded systems, legacy infrastructure and devices that often cannot support a security agent.
The result is an extremely heterogeneous environment where not every device generates the same logs, uses the same protocols or can be managed through the same security controls.
The greatest risk often emerges in the gaps between these domains. A behavior that appears harmless when looking at a single device can become highly significant when correlated with activity elsewhere in the network.
This is why I believe it is essential to observe communications and relationships between assets, rather than focusing only on individual endpoints. You need to understand who is communicating with whom, through which protocols, how frequently and whether that behavior is consistent with what normally happens in that environment.
“Ethical and democratic cybersecurity means making effective protection accessible to every organization, not just to those with the largest budgets.”
Lateral movement makes this particularly important. An initial compromise may have limited impact, but it becomes critical when an attacker can use it to reach other network segments, systems or OT environments.
The real challenge, therefore, is not simply detecting an anomalous event. It is recognized early enough that the event may represent the beginning of a potentially dangerous sequence.
Balancing Automation with Human Oversight
This is one of the most sensitive aspects of autonomous security.
Not every response has the same operational impact. Raising an alert, restricting a specific communication flow and completely isolating a system are very different decisions with very different consequences.
In industrial, healthcare or critical infrastructure environments, cybersecurity cannot be considered in isolation. Operational continuity, safety, asset criticality and the consequences of isolation must all be taken into account.
For this reason, automation should be contextual and progressive.
Decisions can be automated when there is sufficient evidence, a predictable operational impact and a predefined policy governing the response. As the potential impact on business or industrial processes increases, human supervision or approval becomes increasingly important.
The key is that this governance must be designed before an incident occurs, not during the incident.
The objective is not to choose between automation and human control. It is to design a system where each performs the tasks at which it is strongest: machines provide speed, correlation and repeatable execution, while humans define policy, understand business context and make high-impact decisions.
From Detection to Response
I see three developments as particularly important.
The first is the transition from detection based primarily on known indicators toward increasingly behavioral and contextual detection. Attackers can change tools, infrastructure and techniques very quickly. It therefore becomes essential to understand not only what is communicating, but whether that communication makes sense within the expected behavior of the network.
The second is the convergence of environments. The boundaries between IT, OT, IoT and embedded systems will continue to become less distinct. An NDR platform will need to understand very different environments while maintaining a unified view of relationships and communication flows.
The third development is response. Detection alone will no longer be sufficient. Reducing the time between identifying a threat and containing it will become increasingly important, particularly against attacks that rely on lateral movement.
I therefore believe the future of NDR will be defined by the ability to combine visibility, behavioral analysis, correlation and automated response.
Artificial intelligence will certainly play an important role, but the value will not simply come from having “more AI.” It will come from using different models to understand context, reduce noise and transform an anomaly into a reliable operational decision.
The Future of Cybersecurity Expertise
Ideally, cybersecurity professionals should develop a very broad knowledge base: networking, protocols, segmentation, routing, IT and OT architectures, IoT systems, vulnerabilities, anomalous behavior, attack techniques and automated response.
They also need to think in terms of correlation, because a single event rarely tells the whole story. Assets, communications, identities, vulnerabilities, protocols and sequences over time all need to be connected to understand what is really happening.
The challenge is that modern infrastructures have become so complex that even the most experienced cybersecurity expert would struggle to know everything, observe everything and react in real time to every possible combination of events.
That is exactly where technology becomes essential.
Our approach with LECS is based on the idea that technology should augment human capabilities rather than simply replace them. LECS continuously observes the network environment, correlates information across different contexts, analyzes behavior and can react rapidly when it identifies conditions associated with risk.
This means that a security professional does not need to manually understand every protocol, every device and every possible attack sequence present in the infrastructure. Instead, they can rely on a platform capable of maintaining a transversal view across IT, OT, IoT and IoMT environments and supporting them in identifying and managing threats.
I believe this will increasingly define the future of cybersecurity: not humans versus machines, but humans supported by autonomous technology capable of managing a level of complexity that no individual can realistically handle alone.
