Fitness landscapes and their movement in security operations

The objection that should win

Take the SOC lead's case at its strongest. A security operations centre already drowns in signal. EDR telemetry pushes process trees and network connections continuously. Threat intel feeds arrive by the hour. Identity events log every authentication, every privilege escalation, every failed MFA challenge. Configuration drift is checked against CIS benchmarks on a schedule. Analysts triage what the tooling surfaces and hunt for what it doesn't, on a cadence — weekly, sometimes daily if resourced well. The proposal that a system should hold every stream open permanently, treating the whole environment as a running measurement rather than a series of snapshots, sounds like more infrastructure bolted onto an already saturated team.

The objection has teeth for a specific reason: most of what a SOC relies on does not move. TCP/IP does not drift. The MITRE ATT&CK technique for a pass-the-hash attack has not changed its mechanics in a decade. Base image hardening standards are stable for years at a stretch. Building continuous, never-closing intake to catch the fraction of the environment that actually shifts week to week is an enormous engineering commitment for what looks, from a budget line, like a marginal gain over running a thorough hunt on a fixed schedule and retraining detection models each quarter.

That argument deserves to be taken seriously before it is answered, because most of it is correct.

What survives the objection

The stability claim survives almost entirely. A Large Language Model trained on security literature and code will get syntax, protocol structure and the bulk of attacker tradecraft right for a long time, because those things are photographed accurately once and stay true. Retraining periodically, the way detection signatures get updated in batches, closes most of the gap that matters for most of the environment most of the time. Anyone arguing that continuous intake is required because "everything is moving" is wrong, and easy to catch being wrong: ask them to name what changed in Kerberos ticket structure this month.

What does not survive is the inference from "most of the surface is stable" to "periodic remeasurement is sufficient." The failure mode in security operations is not that knowledge decays evenly and slowly. It is that a specific credential, a specific misconfigured service account, a specific lateral-movement path opens on a specific Tuesday and closes, from the defender's side, only when someone next looks. Sewall Wright's 1932 surface makes the general shape of this vivid: height at a point depends on who else is present and at what frequency, and in security operations "who else is present" is an adversary actively working to make yesterday's safe configuration into today's exposed one. Every deployed control flattens the peak it currently occupies, in exactly the way a widely-prescribed antibiotic flattens the resistance profile it faces. The environment a SOC defends is not a fixed genotype space; it is one where a threat actor is running frequency-dependent selection against the defences in real time.

The number that makes this concrete is dwell time: industry telemetry has repeatedly put median intrusion dwell time in the range of two to three weeks, and considerably longer for well-resourced actors. That interval is not a measure of how bad detection is. It is a measure of the gap between one hunt and the next, translated directly into adversary working time. An intrusion does not need to defeat a control. It needs to occupy the interval where nobody is remeasuring.

The allocation problem, not the volume problem

This is where the frozen-corpus argument and the periodic-hunt argument turn out to share a structure. A Large Language Model trained on a corpus with a cutoff is a very good climb on a surface measured once; it is not wrong about anything at the cutoff, and it has no internal signal telling it how much ground has shifted since. A SOC running scheduled threat hunts on a fixed cadence is in the identical position between hunts: not wrong, simply unmeasured, with no signal distinguishing a control that is still sound from one that has quietly failed since Thursday.

The cost of this is not that error accumulates evenly across the environment. It accumulates somewhere specific and unlocated. Two per cent of the identity graph might have drifted into a dangerous state this week — a service account granted excess privilege during an incident and never revoked, a stale federation trust, a misapplied conditional access exception — and a system whose intake closed at the last audit cannot distinguish that two per cent from the ninety-eight per cent that is fine. That is worse than a large, diffuse error, because a large diffuse error at least invites suspicion. A small, unlocated one passes every spot check.

The second objection, and where it bites

A more sophisticated defender of periodic hunting will grant all of this and reply that continuous intake creates its own failure mode: alert fatigue. A SOC that treats every stream as live and every deviation as a signal to re-evaluate will thrash. Analysts already triage thousands of EDR alerts a day; a system that remeasures constantly and surfaces every fluctuation in identity behaviour or config state as a potential compromise will bury the genuine lateral-movement attempt under noise generated by a service account's normal Tuesday-morning batch job. Biology's answer to a deforming surface is often canalisation — robustness through not tracking every fluctuation — rather than faster response. A SOC that damps its intake, trusting known-good baselines and only escalating sustained deviation, may simply be doing the security-operations equivalent of that, and doing it correctly.

This is the strongest objection in the set, and it is largely right. Responsiveness without damping is not vigilance; it is instability, and an analyst chasing every noisy signal from a continuously-open stream will miss the sustained one underneath it, exactly as a population chasing every short-term fitness fluctuation loses the long game to one that hedges.

The reply is narrow but load-bearing: damping requires something to damp against. A system that closed its intake at the last hunt is not robust in the way a well-tuned baseline is robust. It merely resembles robustness for as long as nothing underneath it has moved, and it has no way of knowing when that stops being true. The distinguishing mechanism is provenance. A continuous stream with timestamped, sourced readings — this identity event observed at this frequency from this log source, this configuration check run at this hour against this benchmark — lets an analyst tell a transient (the batch job, again) from a regime change (a credential now behaving in a pattern never seen from that account before) without having to choose between chasing everything and watching nothing. Canalisation done well is a decision made with the data in front of you. Canalisation done by default, because intake closed weeks ago, is just an unmonitored gap wearing the same name.

Where the lineage lands

A Large Language Model trained on threat reports and code is a strong climb on a surface measured at the corpus cutoff: excellent at technique, structurally blind to which credentials, configurations and identity relationships in a live environment have shifted since. A Large World Model — an EDR-fed detection engine actively sensing the current environment — closes part of that gap: it senses drift directly, but only within the scene it currently occupies, which in practice means the endpoint, the segment, the session it is watching, and only for as long as it stays attached. Step outside its scope — a new identity provider integration, a shadow SaaS tenant, a supplier's network — and the sensing stops with it. The Large Universe Model is the position where EDR telemetry, threat intel, identity events and configuration drift are held as one continuously running set of dated, sourced, revisable beliefs, so that a compromised credential detected at 3 a.m. supersedes a clean reading from the previous week's audit rather than sitting alongside it as an equally valid fact.

That position is not a claim that alert fatigue disappears, or that hunting cadences become unnecessary, or that some system will soon monitor everything a SOC touches without human triage. It is the narrower claim that this is the terminal rung on one specific axis — intake — because there is no fifth stance past holding every relevant stream open with provenance attached. Beyond total, dated, continuous observation there is nothing left to add on this axis; what remains, as it does for any SOC today, is coverage, cost and trust in the sources being watched.