Overview
Since prevention sometimes fails, you need controls that notice when something has gone wrong. Detective controls identify and alert on incidents that are occurring or have occurred. They are the eyes and ears of security operations.
Learning objectives
- Define detective controls.
- Give examples across control types.
- Explain why detection speed (dwell time) matters.
Core concept
A detective control discovers and signals malicious or anomalous activity. It does not stop the event by itself — it makes the event visible so people or other controls can respond. Examples:
- Technical: intrusion detection systems (IDS), log monitoring, SIEM alerts, antivirus scans, file-integrity monitoring.
- Administrative: security audits, log reviews, mandatory-vacation policies that surface hidden fraud.
- Physical: CCTV cameras, motion sensors, alarm systems.
How it works
Detective controls generate signals — alerts, log entries, alarms — that feed a response process. Their value depends on coverage (are the right things watched?) and timeliness (how quickly is activity noticed?). A key metric is dwell time: how long an attacker operates undetected. The longer the dwell time, the more damage done, so reducing it is a core defensive goal.
Practical example
An attacker who bypassed prevention logs into a server at 3 a.m. from an unusual country. A detective control — a SIEM rule for impossible-travel or off-hours admin logins — fires an alert. Nothing was blocked automatically, but the security team now knows and can investigate and contain before data is stolen. Without detection, the intrusion could continue for weeks.
Cybersecurity relevance
Detective controls are the heart of the SOC & Blue Team path. They rely on good logging (from the access-control "accounting" step you learned) and on tuning to reduce false positives so real alerts are not lost in noise.
Common mistakes
- Collecting logs but never reviewing or alerting on them.
- So many false-positive alerts that analysts ignore them (alert fatigue).
- Blind spots — not monitoring a system means attacks there are invisible.
Key takeaways
- Detective controls identify incidents in progress or after the fact and raise alerts.
- They span technical (IDS, SIEM), administrative (audits), and physical (CCTV) forms.
- Their worth depends on coverage and speed; reducing attacker dwell time is the goal.
Check your understanding
- How does a detective control differ from a preventive one, using the same scenario?
- What is "dwell time," and why does reducing it matter?