I’m a simple thinker, so let me start simple.
As security leaders, we all share the same three truths:
- We want to keep our people and our brand safe.
- Our biggest pain is uncertainty.
- We need to stop breaches.
That’s it. Three human truths that cut through the noise of vendor slides, analyst reports, and product pitches.
But here’s the problem: our modern networks have outgrown our old ways of thinking.
The Modern Network = One Giant Attack Surface
Once upon a time, the “network” was a data center and some offices. You had a perimeter. You built a moat. You threw EDR at endpoints to keep attackers out.
That world is gone.
Today’s modern enterprise is hybrid, borderless, and sprawling:
- Data centers and cloud workloads.
- SaaS platforms and collaboration tools.
- Remote workers and SASE.
- IoT and OT that were never built with security in mind.
Attackers don’t look at this chaos and see silos of endpoints, cloud, or identity. They see one giant, connected attack surface. And they have one simple objective: get on your network.
The Attackers’ Pitchfork
Here’s the kicker: attackers don’t need a sophisticated arsenal to make it happen. They’ve mastered three prongs of what I call the Attackers’ Pitchfork:
- Disable your controls.
- Avoid your defenses.
- Fool your tools.
That’s it. With this pitchfork, they can bypass endpoint prevention, slide past EDR, and operate inside your hybrid environment undetected.
If you think that sounds dramatic, let’s look at the data:
- 50% of major breaches in 2025 involved attackers bypassing endpoint controls.
- 40% of breaches spanned multiple domains — endpoint, network, cloud, and identity combined.
- And according to CrowdStrike, the average time from infiltration to lateral movement is 48 minutes.
So, I’ll ask the obvious: if attackers can disable, avoid, or fool your EDR in under an hour, are you really safe?
Why the Signal is Bad
If you’re a SOC analyst, you already know the answer. We’ve invested in strong stacks:
- Firewalls, IDS/IPS on the network.
- IAM, PAM, MFA on identity.
- CASB, CSPM in the cloud.
- EPP, EDR on endpoints.
All solid. All necessary. But also… all siloed. Each tool generates alerts. Each adds noise. Analysts drown in false positives. And the “signal” we need to catch real attacks gets buried. The result? Uncertainty.
We’re told to think in terms of multiple attack surfaces. Attackers don’t. They think in terms of one. And if their objective is to get on your network and their path is to get an identity, then shouldn’t our attack signal be rooted in network + identity?
Safety Has Two Sides
Remember the human truth? We want safety. But safety has two sides:
- Pre-compromise resilience: stopping attackers from getting in. (That’s EDR.)
- Post-compromise resilience: stopping attackers already in. (That’s NDR and identity.)
EDR is essential. No question. But it’s not infallible. The pitchfork proves that. NDR and identity detections cover what EDR misses:
- Lateral movement across east-west traffic.
- Credential abuse in cloud services.
- Ransomware precursors in IoT and unmanaged devices.
- Abnormal behaviors that don’t trip a signature but scream “attacker.”
It’s not theory. Healthcare CISOs have done it to protect patient safety. Retailers have done it to secure POS and IoT. Manufacturers have done it to defend supply chains. The outcomes? Visibility they didn’t have. Noise reduction they couldn’t imagine. And speed they desperately needed.
Post-compromise Signal at Speed is Everything
Because here’s the other ugly truth: defenders are slow. Research shows it takes defenders, on average, 292 days to identify and contain an attack. Meanwhile, attackers need less than an hour to move laterally. Why? Because speed is hard.
- Research.
- Monitor.
- Correlate.
- Triage.
- Alert.
- Escalate.
- Investigate.
- Respond.
Rules-based systems can’t keep up. Analysts can’t scale. The workload is crushing. Only AI makes speed achievable — by automating correlation, triage, and prioritization. By turning noise into narrative. By giving analysts attack signal at the speed attackers operate.
The Forward-Thinking CISO
So here we are. Modern networks, modern attacks, modern problems.
Forward-thinking CISOs aren’t buying more tools to throw at the wall. They’re shifting the foundation of their resilience strategy:
- From siloed signals to unified network + identity signals.
- From static prevention to assume compromise.
- From rules and noise to behavioral AI that delivers clarity and speed.
Because stopping breaches isn’t about perfect prevention anymore. It’s about resilient detection and response once attackers are in.
My Simple Thinking
I said I’m a simple thinker, so let’s end simple. We are human. We want safety. We feel pain in uncertainty. We need to stop breaches. Our ability to be resilient comes down to 3 things: Coverage + Clarity + Control.
- Coverage: Network + Identity + Cloud + Endpoint together.
- Clarity: attack signal rooted in network and identity, not siloed tools.
- Control: AI-driven speed that flips the script on attacker advantage.
That’s how forward-thinking CISOs are neutralizing the Attackers’ Pitchfork.
Final Thought: Why Network and Identity Security are the Future
The modern network is borderless. The attackers’ pitchfork is simple but deadly. EDR alone isn’t enough. So ask yourself: is your attack signal rooted where attackers actually operate — in the network and with an identity? Because that’s where safety, certainty, and resilience live.
Sources:
- Gartner SRM London presentation: EDR Isn’t Enough – Building Modern Attack Resilience with Network + Identity
- Verizon, CrowdStrike, IBM, Mandiant, Zscaler, Cisco, Palo Alto — breach and endpoint protection failure data
- CrowdStrike 2025 Global Threat Report — average 48 minutes from infiltration to lateral movement
- Vectra AI, State of Threat Detection and Response – The Defenders’ Dilemma (2024, 2023) — SOC analyst pain points, uncertainty, and signal clarity challenges