Security's Most Expensive Assumption

Whenever a major breach makes the news, boards ask their security leaders the same question: could that happen to us, and would we see it?

The answer usually comes as a dashboard. So many rules deployed, so many attack techniques covered, so many alerts handled last quarter. What the dashboard can't say is whether any of those defenses would actually fire if that attack started tomorrow. In most organizations, nobody knows. The defenses are assumed to work, not proven to.

A broken defense looks like a quiet day

Organizations spend heavily to collect security data and write detection rules on top of it. Those rules are usually tested once, if ever, and then trusted for years.

Meanwhile the environment underneath keeps changing. Teams adopt new cloud services and AI tools, migrate between platforms, and cut the data they send to the SIEM to control costs. Vendors update their products and change the data they produce. Any of these can quietly break a defense, and nothing raises an error when it does. A rule that can no longer fire looks exactly like a rule with nothing to catch. Often the first time anyone notices is after an incident.

Every other discipline checks its work

Software teams test every change before it ships. Finance teams close their books against audited numbers. Machine learning teams measure a model against data it has never seen before trusting it in production.

Security operations, the function whose whole job is to catch attackers, mostly takes its own detection on faith. The checks that do happen are occasional exercises that reflect one environment on one day, and they start going stale the moment something changes.

AI raises the stakes

The industry is racing to put AI agents in charge of the SOC, and for good reason: an agent can triage and investigate in seconds what used to take an analyst hours. But an agent is only as good as the evidence it's given. It can't investigate an attack that never triggered an alert. And when data is missing, it reads the gap as "nothing happened" and moves on, with more confidence and at far greater speed than any person would.

AI is also writing detection rules now, which means more of them, produced faster, with even less time spent proving they work. Automating on top of an unverified foundation doesn't remove the assumption. It multiplies it.

Proof becomes the standard

We think the next phase of security operations will be measured by proof. Security leaders will be expected to show, continuously and with evidence, which attacks they would catch, which they would miss, and why. Boards will ask for it. And it's the only way AI agents in the SOC can be trusted to make decisions on their own.

For anyone building or investing in the AI SOC, that's the part worth watching. The hardest problem isn't the model. It's whether the evidence underneath it is real.

At Brava, this is the problem we're working on, and we'll share more soon. Until then, here's a question for every security leader: if your board asked tomorrow which attacks you'd miss, could you answer with evidence?