Cybersecurity Spends Billions Spotting Attacks. It Should Be Stopping Them.

Key points

• More than 70 percent of the 500-plus companies that entered the RSAC Conference startup competition over the past three years sell detection tools, not prevention tools.
• IBM's Cost of a Data Breach Report shows that faster detection reduces financial damage, but the average global breach still costs millions because detection doesn't stop the first intrusion.
• Common causes of breaches remain unchanged: known software flaws, stolen credentials, and misconfigured systems account for most incidents.
• AI tools now generate phishing emails, fake messages designed to trick people into handing over passwords, at a scale no human team can match.

The cybersecurity industry has a spending problem. Not a shortage of money. A mislabelling of what that money buys.

Most new security products are built around detection: software that watches for signs of an intrusion after criminals are already inside a network. The tools are good at what they do. But they activate only after something has already gone wrong, and that's a problem the market hasn't priced in honestly.

Writing for CSO Online, security professionals argue this has tipped the balance too far. The original point of security was to stop attacks before they landed, not to document them afterwards.

How did the industry end up here?

It happened gradually. Early computer networks were simple enough that firewalls, which act like locked doors between a company's systems and the outside world, and antivirus software could block most threats at the boundary. Networks then grew larger and more complex. Criminals found ways around the perimeter. So vendors built tools to watch what was happening inside networks instead: intrusion detection systems and, later, Security Information and Event Management platforms, known as SIEM, which collect and analyse logs from across an organisation to flag suspicious activity.

Detection was always meant to complement prevention. Somewhere along the way it became the main event.

Today, security teams measure success by how quickly they spot a problem and contain it. Executives track mean-time-to-detect, the average gap between an intrusion starting and a team noticing it. The assumption baked into that metric is that a breach is inevitable. You just have to limit the damage.

That assumption is expensive. IBM's data shows faster detection cuts costs, but breaches still cost millions on average, because a criminal who's already inside has already won the first round. As we noted in our 13 July story on visibility versus survival, security teams can monitor everything and still lose everything.

The structural causes of breaches have barely shifted. Known vulnerabilities, stolen credentials, and systems left open by configuration errors account for most incidents. All three are preventable before an attacker ever arrives.

Detection tools also produce a relentless stream of alerts, many of them false alarms. Security staff spend hours filtering noise to find genuine threats. Alert fatigue is real. Talented analysts are scarce. As AI lowers the cost and skill required to run large-scale attacks, alert volume will only climb.

Should you worry about the prevention gap?

Yes, particularly if your organisation is still treating detection dashboards as its primary defence. Prevention changes the maths. Requiring phish-resistant multi-factor authentication, which means a login requiring a second proof of identity beyond a password, blocks most stolen-credential attacks outright. Patching known flaws before criminals exploit them removes entire categories of risk. Splitting networks into segments limits damage if something does get through.

Organisations that do these things well have fewer serious breaches and lower long-term costs, according to available research. The alerts that remain are easier to investigate because the background noise is lower.

Audit which security budget lines prevent problems and which only report them. Detection is still essential, but it works best when prevention has already shrunk the field of threats it needs to cover. The industry's habit of measuring how fast it sees a breach rather than how rarely one happens is the thing worth watching most closely here.