The gap between the time an attacker evades prevention security at the perimeter to being discovered is measured in weeks or months, which is why shifting from signatures to behavioural-based detection is key.