We're obsessed with the wrong metric. Every time a major breach surfaces, the cybersecurity industry pivots to a single number: how many records were stolen? Two and a half million here, 130 firms there. We've built an entire discourse around data volume as the measure of breach severity, and it's leading us toward a dangerously incomplete understanding of what's actually breaking down.
The real story isn't about bigger breaches. It's about faster ones.
Consider the timeline that's been emerging across recent incidents: breaches detected weeks or months after entry, threat actors establishing persistence across multiple vendor platforms, coordinated attacks against entire ecosystems. What these cases share isn't record volume but something more structural: the speed at which attackers can now move through an organization's defenses, pivot to adjacent targets, and extract value before detection triggers.
This matters because our current breach-response infrastructure is calibrated for the old game. Compliance frameworks measure breach notification timelines in days. Insurance policies price risk based on exposed records. Board conversations fixate on "how many?" rather than "how fast?" We've optimized our entire risk apparatus around a metric that no longer tracks the actual threat.
The Okta breach and its ripple effects across 130 downstream victims illustrates this shift perfectly. The headline number became the firm count, but the real vulnerability wasn't the size of the initial compromise. It was the velocity at which a single authentication platform could become a distribution channel for downstream attacks. One entry point, dozens of exits, and the attackers had already moved to the next target before many victims understood they'd been compromised.
This acceleration isn't accidental. It reflects a structural change in how modern software gets built and deployed. Cloud services, API integrations, and third-party dependencies have created a topology where breaches aren't discrete events anymore. They're cascade failures. An attacker who gets inside one platform has a roadmap to ten others, all documented in integration dashboards and configuration files. The time between "initial compromise" and "widespread exploitation" has compressed from months to hours.
Yet our defenses remain organized around detection and notification speeds that assume the old timeline. Security teams are hired and trained to catch attackers weeks into an intrusion. Incident response playbooks describe multi-day investigation periods. Executive reporting cadences operate on quarterly cycles.
None of that works when the attacker's entire engagement window is measured in days.
This isn't an argument to abandon breach detection entirely. It's an argument to fundamentally reweight what we measure. If the future breach is defined by velocity rather than volume, then the priority shifts. We need visibility into lateral movement, not just exfiltration volume. We need real-time cascade detection, not post-incident forensics. We need to understand a compromised platform's downstream dependencies faster than an attacker can weaponize them.
That's a different security posture. It requires different tooling, different team structures, and different metrics at the board level.
The organizations that will navigate the next generation of breaches successfully won't be the ones with the most sophisticated forensic capabilities. They'll be the ones that stop celebrating how quickly they noticed they'd been compromised, and start optimizing for how quickly they can prevent their compromise from becoming someone else's problem.
We're still keeping score on the wrong field. The scoreboard needs to change before the game does.