Introduction: What the Defenders Never Saw

Every red team engagement produces two kinds of findings. The first is what the attacker was able to do. The second — often the more valuable, is what the defenders never saw happen. Across SISA's red team engagements and security assessments, that second category has been strikingly consistent: a recurring set of techniques that reach their objective without generating a single alert in the SOC.

These are not theoretical gaps. Each one below was directly observed — an action a red teamer performed that should have lit up a dashboard and simply didn't. Organizations tend to measure their security by what their prevention controls block. But prevention is the layer attackers expect to bypass; detection is what turns a successful bypass into a contained incident rather than months of undisturbed access. The distance between those two outcomes is dwell time, and dwell time is a detection problem.

Across engagements SISA conducted between 2024 and 2026, one pattern consistently emerged: the controls meant to catch post-compromise activity were either not configured to alert, or not correlating the signals they already had. The five gaps below are where that failure surfaced most often, grouped by the layer where the activity happened.

Top 5 Detection Gaps and the Missing Controls

1. Identity — Credential-Based Attacks Go Undetected

Identity is where most engagements begin, and it is where detection failures are most expensive, because a valid credential used by the wrong person still looks like a valid credential. Time and again, the SOC could not distinguish legitimate authentication from an attacker reusing the same credentials from somewhere new. The signals to tell them apart existed; nothing was watching for them.

• Successful logins from foreign or previously unseen IP addresses raised no alert — a compromised credential is indistinguishable from the real user unless location and device are part of the signal.

• Password-spray attempts were not correlated across accounts, so a slow, low-volume spray touching many users stayed comfortably under each account's individual lockout threshold.

• Dark web credential reuse went unmonitored, leaving already-leaked passwords valid and unflagged.

• Access to browser-saved credentials after a phishing foothold was not logged, hiding the exact moment an attacker harvested stored secrets.

• Newly created email forwarding rules — a classic persistence and quiet-exfiltration mechanism — were never flagged.

These are the same identity attack paths a focused Active Directory penetration test is designed to walk, on-premises and in the cloud, before an attacker does.

2. Endpoint — Endpoint Activity Not Visible to the SOC

Endpoint tooling is usually the most heavily invested control in the stack, yet red teamers repeatedly operated on managed endpoints without producing an actionable alert. The method was almost always the same: live in memory, or work in the places the endpoint agent was not watching.

• In-memory PowerShell execution — tooling loaded through IEX and IWR rather than written to disk — ran without alerting, because detection keyed on files that were never created.

• Virtual-machine creation on a managed endpoint went unmonitored, handing the red team a blind space to run tooling entirely outside the agent's view.

• USB HID (human-interface device) registration raised no alert, leaving the door open to keystroke-injection attacks.

• Low-privilege installation of Python and other scripting runtimes was not flagged, quietly assembling a full offensive scripting environment.

• A command-line SmartScreen bypass executed with no detection at all.

Confirming whether an EDR actually raises these events, rather than assuming it does — is precisely the work of adversary simulation and threat emulation.

3. Network — Internal Network Activity Not Correlated

Once inside, lateral movement and internal reconnaissance throw off distinctive signals — but only if something is correlating them. In these engagements the telemetry was often collected in pieces and never assembled into a picture an analyst could act on.

• A new MAC address and Dynamic Host Configuration Protocol (DHCP) lease appearing on the network raised no alert, so an unauthorized device joined unnoticed.

• Kerberoasting was not detected, despite the tell-tale burst of service-ticket requests it generates.

• BloodHound and Lightweight Directory Access Protocol (LDAP) enumeration of the directory went unflagged, even though bulk directory reads are a hallmark of attack-path mapping.

• Exfiltration over CDN tunnels and QUIC was neither blocked nor alerted, blending into ordinary encrypted traffic.

Surfacing how far these signals go uncorrelated is a core outcome of internal network penetration testing.

4. Application — Application-Layer Abuse Invisible

Application-layer abuse is among the hardest activity to detect, because each individual request is valid; the attack lives in the pattern and the volume, not in any single call. SISA's testers exercised these applications freely without tripping any monitoring.

• Bulk API enumeration during IDOR testing was neither rate-limited nor alerted, allowing mass extraction one legitimate-looking request at a time.

• Authentication parameter manipulation was not logged, so tampering with the login logic left no trace to investigate.

• GraphQL introspection queries — used to map an API's entire schema in a single sweep, were not monitored.

• Debug endpoint access from external IP addresses raised no alert.

• Password hashes exposed in API responses went undetected, leaking secrets in plain sight.

These blind spots are exactly what dedicated API security testing is built to find, at both the request and the volume level.

5. Cloud — Cloud Enumeration Not Visible

Cloud control-plane activity is logged by default, but logging is not detection. In these engagements the telemetry was present and simply had nothing watching it.

• AWS API calls from a new IP or region raised no alert, because GuardDuty was absent or misconfigured.

• Bulk Microsoft Graph API queries — mass enumeration of the tenant, were not flagged.

• Bulk SharePoint file access went unmonitored, missing large-scale data harvesting as it happened.

• MFA misconfiguration on service accounts was never audited, leaving a standing gap in the identity perimeter.

• Identity & Access Management (IAM) key age was not tracked, so long-lived keys stayed in place, unrotated, indefinitely.

A cloud security assessment evaluates exactly these layers — configuration, IAM, and monitoring settings — to find the gap between what the cloud records and what anyone is actually alerted to.

Conclusion: The Absence of an Alert Is Not the Absence of an Attack

None of these five gaps required an attacker to defeat a security control. Each one required only a control that was not watching, or not correlating the signals it already collected. That distinction matters, because prevention and detection fail in different ways. A bypassed prevention control is a single event. An undetected intrusion is a duration — and the longer it runs, the more surely a containable incident becomes a breach.

Closing these gaps is less about buying more tooling than about making the tooling already in place see and correlate activity across identity, endpoint, network, application, and cloud together — the role a ProACT Agentic SOC is built to play. Equally important is proving that detection works before an adversary tests it for you: breach and attack simulation validates that telemetry and alerting fire as intended across every layer, and purple team exercises let offensive and defensive teams tune those detections side by side, in real time.

Because in security operations, the absence of an alert is not the same as the absence of an attack, and the only way to know the difference is to test it.