Hoplite Labs

Abstract: A candid look at why organizations lose visibility into their own environments and how attackers exploit that confusion. The post focuses on simple, defensible improvements rather than tooling overhauls.

—

A small signal appears. Nothing dramatic — a login that doesn’t look quite right, or an alert that isn’t clearly urgent.

Nothing triggers a fire drill. The issue just needs checking. Someone pulls logs. 

At that point, the assumption is still intact: “We’ll be able to figure this out.”

That assumption is reasonable. Most mid-market environments have logging in place. Monitoring exists and alerts are tuned.

What’s harder to see is how that confidence holds up when something doesn’t resolve cleanly. It’s not whether the data exists. It’s whether it comes together fast enough to matter.

Recent incidents have made that gap harder to ignore. In the April 2026 Vercel breach, attackers leveraged a trusted OAuth integration and remained within the environment for over a year. The activity looked legitimate, and by the time it was understood, early visibility was already gone.

That pattern isn’t unusual. It’s just easier to recognize after the fact. Inside most environments, it looks quieter than that.

Where Incident Visibility Slows Down

The issue isn’t that nothing is visible. It’s that nothing is clear, especially when it’s needed most.

A problem arises, and teams hunt for answers. But answering basic questions takes longer than expected:

• When did this issue start?

• Is it isolated or spreading?

• Have other systems or tools touched it?

Someone checks one system, then another. Timestamps don’t align. The activity still looks normal enough to hesitate. What should take minutes turns into an extended investigation.

Nobody says it directly, but the shift is obvious: “We’re not sure what we’re looking at yet.”

This is where visibility fails.

Why These Visibility Gaps Persist

This isn’t a failure of logging. It’s a mismatch between how visibility is set up and how activity actually unfolds.

Most environments are built system by system. Logging is configured when something is deployed. Alerts are tuned around that system in isolation. Over time, those activities paint a picture that feels complete.

But activity doesn’t stay contained to one system. Access starts in one place, moves through identity, and touches multiple systems along the way. By the time something needs to be understood, the relevant activity is spread across those systems.

Visibility is still organized by system. The activity that teams are trying to understand is not. 

For example, most initial access now happens through identity-based techniques like valid credentials, tokens, or approved integrations. Attacker activity becomes disguised as ordinary business behavior. 

Palo Alto Unit 42 reports cases where an attacker reset MFA through a help desk interaction and operated entirely through legitimate access. No alerts were triggered because nothing appeared out of place.

In many environments, evidence of intrusion exists, but it is fragmented. Relevant activity may be logged in multiple places, kept for different periods, or tied to identities not easily mapped back to one user or action. Reconstructing an incident requires stitching those pieces together under time pressure. 

That gap is where expensive delays form.

Visibility Delays Turn Into Higher Costs

Teams still need to make decisions, even when they don’t fully understand what they’re seeing. So they pause to confirm the scope:

• “We don’t see anything else yet.”

•  “We’re still validating.”

Those statements aren’t wrong. But while teams are confirming what’s happening, the activity continues. Time is lost trying to understand the problem instead of containing it.

This point is where most incidents expand. The entry wasn’t sophisticated, but full understanding lagged activity. Detection time expands, and costs follow: When detection and containment stretch past 200 days, IBM says organizations pay over $1 million more in breach costs.

In mid-market environments, that lag carries even more weight. The same team responsible for maintaining systems must also determine an incident’s source, path, and blast radius. Nobody else is waiting to reconstruct events cleanly. Any external support rarely covers the entire environment in real time.

Teams are left to figure it out alone.

How Mature Teams Handle Visibility Differently

They don’t assume visibility holds because logging exists. They test whether it does. Not in theory, but in practice:

• How quickly can we determine when an issue began?

• Can we follow activity across systems without guessing?

• Do we trust what our alerts are signalling?

The goal is not collecting more data but removing hesitation.

In environments where this is done well, the difference is noticeable. The same signals appear, and the same questions arise. But the answers come faster — and decisions follow with more confidence.

There is no pause to determine what’s visible. That work has been done before an incident occurs.

In many cases, that clarity comes from having walked those paths before — seeing how access actually moves, where activity becomes hard to interpret, and how long it takes to answer basic questions when something is off.

By the time an actual situation unfolds, teams face fewer unknowns and make better decisions sooner.

Close Your Visibility Gap with Validation

Most mid-market environments are not blind. They have logging, monitoring, and coverage across important systems.

What they lose over time is the ability to turn that visibility into straightforward answers when something is off.

That loss is gradual. It shows up in hesitation — when simple questions take longer to answer, and teams have to act without straightforward answers.

Attackers thrive in that gap.

Closing it requires understanding how an environment actually behaves and preparing teams to answer questions about that environment without delay. 

—

If you’re not sure how your environment holds up under pressure, test it before you have to rely on it.