Two products, one wire
A seismic monitoring network was never one system. Broadband seismometers, strong-motion accelerometers and GPS receivers feed the same telemetry into two entirely different products. One is the catalogue: revised, authoritative, published days or years after the event, the raw material of earth science. The other is the warning: issued in seconds, exploiting the plain fact that a P-wave and the electrical signal describing it outrun the S-wave that does the damage. Cybersecurity built the same fork without borrowing the metaphor deliberately. A CVE entry, patched, cross-referenced, sitting in a database for a decade, is the catalogue. A detection engineer's alert queue at 3 a.m. is the warning. Same instruments, same wire, two products with different clocks.
The lineage from Large Language Model to Large World Model to Large Universe Model is a lineage of intake, and it maps onto that fork exactly. A disclosure feed archived, indexed and queried after the fact — a static corpus of past CVEs, exploit writeups, vendor advisories frozen at training time — is the Large Language Model position: comprehensive, well-organised, and structurally unable to tell you what changed an hour ago. A single scanner reading one host's live configuration is the Large World Model position: present-tense, grounded in a real machine, but blind to everything outside the scene in front of it. Neither is where earthquake early warning lives, and neither is where a working detection stack lives either. The third position is every stream running at once — disclosure feeds, telemetry, malware corpora, configuration drift — held as a belief about exposure that is continuously revised, with each revision tagged to the feed that forced it. That is the Large Universe Model position, and it is the only one on this axis that can close a live gap before it is exploited.
The ninety-day window
Here is the gap. A vulnerability is disclosed. The relevant patch or mitigation exists somewhere in a vendor bulletin. The organisation's actual exposure — which hosts run the affected version, which have compensating controls, which are internet-facing — sits unassessed until the next scheduled audit, typically ninety days out. For those ninety days the exposure is open and nobody is looking at it, because looking at it was scheduled, not triggered.
This is exactly the batch-versus-stream distinction seismology worked out with Milne's mailed seismograms. Milne's network posted records by ship; the corpus arrived months late and was still excellent geology. Nobody would run tsunami warning off it. A ninety-day audit cycle is mailed seismograms: it produces a perfectly good compliance artefact and a worthless defence against an actively exploited disclosure. The claim worth making precisely is not that continuous scanning is generally superior to periodic audit — plenty of an organisation's risk posture is well served by a quarterly review, the same way most seismic data has no attached decision window and is more valuable revised than fast. The claim is conditional: where an exploit is public and a scanner is not running against current configuration, the value of catching it is a step function, not a curve. Day one of exposure and day eighty-nine of exposure are not different quantities of risk. They are the same outcome waiting to happen, and no quarter-end accuracy improvement recovers the eighty-nine days a streaming system would not have lost.
Position one: continuous intake is the only defensible architecture
The detection engineer's case is blunt. Disclosure feeds, EDR telemetry, threat-intel corpora and configuration-management drift are all cheap to stream continuously and expensive to reconstruct after the fact. Once a system correlates a new CVE against live asset inventory the moment the CVE lands — not at the next audit, not at the next patch Tuesday — the ninety-day window collapses to whatever the scan interval is. This is the Large Universe Model position pushed to its proper conclusion: nothing is held as settled truth, every belief about "we are exposed" or "we are not" carries a timestamp and a source, and it gets overwritten the instant a better source disagrees. A configuration-drift feed that says a firewall rule changed twenty minutes ago should outrank a CMDB entry six months stale, and a system built on continuous intake can express that ranking. A system built on periodic snapshots cannot, because it has no competing sources in flight to rank.
Position two: the earliest signal is usually wrong, and wrong at scale is worse than late
The counter-case is not weaker for being familiar. Japan's earthquake early warning system has issued alerts triggered by lightning and by two unrelated quakes registering as one; in 2013 a warning intended for a magnitude 7.8 event near Awaji produced a nationwide alert for something that turned out to be magnitude 2.3. Streaming intake does not remove estimation error. It often manufactures it, because the earliest possible estimate is built from the fewest data points, and the fewest data points is the noisiest sample available.
Cybersecurity's version of the 2.3-for-7.8 alert is well known to anyone running a SOC. A configuration-drift detector correlated hastily against a fresh CVE flags half the fleet as critically exposed because a version string matched a pattern that a slower, more careful parser would have excluded. The fab that halts lithography on a spurious seismic alert loses more than a mild quake would have cost it; the security team that pages every on-call engineer at 4 a.m. over a false positive burns trust that takes months to rebuild, and the next real alert gets a slower, more sceptical response because of it. Continuous intake, run badly, degrades the signal it was built to sharpen.
Fast and continuous is not the same as accurate. You have simply moved the argument from "did we miss it" to "do we believe the thing telling us in real time," and that argument is harder, not easier.
The answer has to concede the mechanism and reject the conclusion. The remedy for a noisy early estimate is not less intake — it is more simultaneous corroborating sources and provenance rigorous enough that an analyst can see exactly which feed triggered the alert and weight it accordingly, the way JMA's system revises magnitude as more stations report rather than trusting the first one. A detection stack that logs which of the four correlated feeds actually fired, and at what confidence, gives the engineer a defensible basis for triage that a quarterly report never offers, because a quarterly report has no concept of confidence at all — it is simply what was true when someone last checked. The false-positive cost is real and underrated. It is an argument for better estimator design and disciplined alert thresholds within continuous intake. It is not an argument for retreating to batch. A ninety-day audit cycle does not have fewer false alarms than a live correlation engine. It has no alarms, which is a different and worse thing than a well-tuned one.
Position three: the actuator, not the feed, is where the value sits
The second objection cuts deeper and deserves full concession. Continuous intake that terminates in a dashboard nobody watches is exactly the Indian Ocean tsunami problem: the Pacific Tsunami Warning Center had the Sumatra earthquake located within minutes in 2004 and there was no dissemination path to a beach in Aceh. Roughly 230,000 people died over the following two hours, many with an hour of warning time theoretically available and no mechanism to spend it.
A disclosure feed correlated against live asset inventory in real time is worth exactly nothing if the output is a Slack message a detection engineer reads on Monday. The actuator in this domain is automated patch orchestration, or a firewall rule pushed without a human approving it at 2 a.m., or an isolation action that quarantines a host the instant exposure and active exploitation coincide. Building that actuator is organisational work — change-management sign-off, rollback tooling, the political cost of an automated action that breaks something — and it is nowhere near solved by better feeds. Shinkansen trains survive earthquakes because a signal cuts traction power without anyone in the loop; that automation took decades to build and trust, long after the sensing network existed. Most security organisations are still at the stage of sensing without the equivalent pre-wired response, and no amount of additional intake fixes that gap. Intake is necessary. It is nowhere close to sufficient.
What the argument actually claims
Put the two positions together rather than choosing between them, and the thesis narrows rather than collapses. Intake has a terminal position: every disclosure feed, every telemetry stream, every corpus and every drift signal, running without a stopping point, held as belief with provenance and decay, is the ceiling. There is no fourth kind of evidence beyond that. But actuation does not have a ceiling — automated response, orchestration, trust in the pipeline to act without a human, keeps improving indefinitely, and most of cybersecurity's real gap sits there, not in the feeds. And accuracy at the moment of intake is a separate engineering problem, solved not by throttling back to batch but by demanding better provenance from the streams already running, exactly as a seismic network improves its five-second estimate with more stations, not fewer. The ninety-day exposure window is real, it is closable by continuous correlation, and closing it does not mean the job is finished. It means the job has moved to where continuous intake always eventually pushes it: what gets triggered when the belief updates, and whether anyone trusts it enough to let it act alone.