In elastic cloud environments a threat can spread workload-to-workload faster than a human analyst can react, so automated response speed decides the outcome.
compromised(t+1) += spread - contained
contained ~ response_speed * telemetry_coverage
- Cloud workloads — containers/VMs/functions in the monitored cloud environment.
- Telemetry coverage — share of workloads actually emitting security telemetry to the detection engine.
- Threat spread rate — how fast a compromise propagates to adjacent workloads.
- Response speed — how quickly automated response isolates a detected compromise.
Modern CDR (cloud detection and response) platforms race exactly this clock — mean-time-to-contain now matters more than mean-time-to-detect alone.