The Surveillance Paradox: We See Everything, Yet Understand Nothing

 

The Nine Days Before the Ransomware

On February 12, 2024, attackers gained access to Change Healthcare, one of the most consequential healthcare technology providers in the United States.

The 2024 Change Healthcare Cyberattack. The American Hospital Association (AHA) highlights how the ALPHV/BlackCat ransomware attack disrupted critical healthcare operations across the United States.

They did not initially require an elaborate zero-day exploit or an unknown malware capability.

According to testimony from Andrew Witty, then CEO of UnitedHealth Group, the attackers used compromised credentials to access a Citrix remote-access portal that did not have multifactor authentication enabled.

Once inside, they moved laterally through the environment and exfiltrated data.

Nine days later, on February 21, ransomware was deployed.

The resulting disruption affected healthcare claims processing, payments, and other essential services across the United States.

What interests me about this incident is not merely the absence of multifactor authentication, although that failure was significant.

It is the distinction between what a security system can observe and what an organization can establish from those observations.

A successful authentication proves that an authentication mechanism accepted a credential. It does not, by itself, prove that the person using the credential was authorized to act.

Similarly, a permitted network connection does not necessarily represent legitimate activity. An approved administrative utility can be used for malicious purposes, and access to sensitive information does not automatically establish a legitimate reason for retrieving it.

The publicly available account of the Change Healthcare incident does not establish which specific security alerts were generated or overlooked during those nine days. We should not invent that history.

But the incident still illustrates an important security problem.

A system can technically accept an action while the action itself remains malicious.

Security monitoring can record the occurrence of an event without necessarily understanding its intent or significance.

And in an environment where trusted identities, legitimate tools, and authorized communication channels can all be abused, that distinction becomes critical.

This contradiction has fascinated me for some time.

We have built cybersecurity infrastructures capable of observing enormous quantities of digital activity. Yet the ability to collect information has not eliminated our difficulties in interpreting what that information means.

Perhaps the greatest paradox of modern cybersecurity is not that we cannot see enough.

It is that we have mistaken the ability to observe everything for the ability to understand anything.

The Illusion of Total Visibility

Cybersecurity has developed an almost instinctive response to uncertainty.

Collect more information.

Deploy more sensors. Enable additional logging. Integrate threat intelligence feeds. Expand attack surface monitoring. Extend endpoint visibility. Introduce AI-powered detection and response.

The reasoning appears sensible. If we observe more activity, we should become better at detecting malicious behaviour.

But this assumption contains a weakness.

More observations do not necessarily produce more knowledge.

Consider the modern Security Operations Center.

A SIEM platform can ingest millions of events from numerous technologies. An EDR platform can record process executions, system modifications, and network activity. Identity systems can monitor authentication requests and privileged access.

Yet each observation represents only a fragment of the environment.

A detection rule may identify unusual PowerShell activity.

Does that mean an attacker is executing commands?

Not necessarily.

A monitoring platform may report successful authentication from an unfamiliar location.

Does that establish account compromise?

Again, not necessarily.

Conversely, an attacker using legitimate credentials and approved administrative tools may generate events that appear entirely ordinary.

The observation can be accurate while its interpretation remains uncertain.

This is an epistemological problem.

Epistemology, the philosophical study of knowledge, asks how we know something, what constitutes sufficient evidence, and how we justify our conclusions.

Cybersecurity operates within these questions every day.

When an analyst receives an alert, what is actually known?

Do we know that an attacker is present?

Or do we merely know that a particular activity satisfied a detection condition?

There is an enormous difference between those statements.

An alert is evidence that something occurred or was detected according to a defined rule.

It is not necessarily proof of malicious intent.

Accuracy of observation does not guarantee accuracy of interpretation.

This becomes especially dangerous when organizations begin to confuse their investment in monitoring technologies with the quality of their situational awareness.

Michel Foucault and the Architecture of Surveillance

To examine the paradox more deeply, we need to temporarily leave cybersecurity.

Michel Foucault's Discipline and Punish: The Birth of the Prison (1975) explores how surveillance becomes a mechanism of power, discipline, and behavioural control.

In his 1975 book Discipline and Punish, French philosopher Michel Foucault explored the relationship between surveillance, power, and human behaviour.

One of his most influential discussions concerned the Panopticon, a prison design proposed by Jeremy Bentham.

The architecture placed an observation tower at the center of a circular arrangement of cells.

Prisoners could potentially be observed at any moment, but they could not reliably determine when they were actually being watched.

For Foucault, the significance was not simply that surveillance was possible.

It was that the possibility of surveillance could influence behaviour.

Observation became a mechanism through which authority could exercise discipline.

Now consider the architecture of modern cybersecurity.

We deploy monitoring systems across networks, endpoints, identities, cloud environments, and applications.

Every authentication attempt can become a log entry. Every privileged operation can generate an audit event. Every suspicious network connection can appear within a monitoring platform.

In many respects, we have constructed digital observation towers.

But Foucault's analysis also exposes a limitation in how we think about security visibility.

The ability to observe behaviour is not equivalent to understanding that behaviour.

A security platform can identify that an employee accessed confidential information.

It cannot necessarily determine whether that access was appropriate.

It can record an outbound data transfer.

It cannot automatically establish whether the transfer was authorized, negligent, or malicious.

It can observe a successful authentication.

It cannot conclude from the authentication event alone that the legitimate account owner initiated the session.

Surveillance creates the possibility of observation.

It does not establish the truth of every interpretation.

Imagine an organization reporting that 98% of its endpoints are monitored.

That might represent meaningful operational progress.

But what does the figure actually prove?

Does it establish that the monitoring technology can detect every relevant attack technique?

Does it account for unmanaged assets?

Does it establish that the telemetry is complete, reliable, and retained long enough for investigation?

Does it prove that analysts can reconstruct an intrusion from the recorded evidence?

Clearly not.

Monitoring is a capability. Understanding is an achievement.

And confusing the two creates an illusion of control.

When the Attacker Lives Outside the Dashboard

The limitations of monitoring become even clearer when we examine how adversaries deliberately exploit security blind spots.

In March 2026, Google Cloud published M-Trends 2026, drawing on more than 500,000 hours of Mandiant incident investigations conducted during 2025.

One of its findings concerned attackers establishing persistence within infrastructure that conventional endpoint-monitoring approaches struggle to observe.

Edge appliances and virtualization environments were particularly significant.

Traditional EDR tools are often designed for general-purpose operating systems.

But network appliances, hypervisors, and specialized infrastructure do not necessarily support the same monitoring capabilities.

Attackers recognize this difference.

Mandiant described adversaries abusing legitimate administrative functions, compromising poorly monitored infrastructure, and establishing long-term access outside conventional endpoint visibility.

The report found that global median attacker dwell time increased from 11 days to 14 days.

For certain espionage and North Korean IT-worker-related incidents, the median was substantially longer.

The report also described BRICKSTORM-related cases with average dwell times of approximately 393 days.

Think about that.

An organization might maintain extensive security telemetry across thousands of workstations and servers while an attacker persists within an infrastructure component that generates comparatively little useful evidence.

The problem is not necessarily the absence of cybersecurity technologies.

It is the difference between the environment the organization believes it can observe and the environment that actually exists.

This distinction becomes especially important when security teams rely heavily on consolidated dashboards.

A dashboard may be functioning correctly.

Its data sources may be reporting normally.

Its correlation rules may be operating exactly as designed.

But if the compromised system sits outside those data sources, the dashboard may still provide a reassuring but incomplete representation of reality.

There is an uncomfortable implication here.

A security dashboard can be technically accurate and operationally misleading at the same time.

It may accurately describe everything it can see while omitting the most consequential activity occurring beyond its visibility.

We should therefore distinguish between two surveillance failures.

The first is observational failure, where relevant evidence is never captured.

The second is interpretive failure, where evidence exists but its significance is misunderstood.

These failures can occur independently or together.

Collecting more telemetry can help address the first.

It does not automatically solve the second.

When Information Becomes Noise

Consider a hypothetical incident.

At 9:14 AM, an account successfully authenticates to a corporate VPN from an unusual location.

At 9:17 AM, the same account accesses a sensitive file repository.

At 9:21 AM, an endpoint executes a legitimate administrative utility.

At 9:26 AM, a large quantity of data is transferred to an external cloud service.

Four events.

Four observations.

Potentially four different security technologies.

Individually, each event may have a plausible explanation.

The authentication might reflect business travel. The file access might be legitimate. The administrative utility might be required for maintenance. The external transfer might represent an approved business workflow.

But when examined together, the sequence suggests another possibility.

The account may have been compromised. The administrative activity may represent discovery or collection. The external transfer may constitute data exfiltration.

Notice what happened.

No new observation was necessarily required to recognize the hypothesis.

What changed was the interpretation of the relationships between the observations.

This is the difference between telemetry and intelligence.

Raw data records what was observed.

Context describes the circumstances.

Correlation connects related observations.

Interpretation evaluates competing explanations.

Judgment determines what action is justified.

These are separate cognitive and operational functions.

A SIEM platform may be excellent at collecting and correlating events.

But correlation is not causation.

Five events occurring within the same period do not automatically belong to the same attack.

Similarly, a coherent attack narrative does not become true simply because an analytical engine successfully connects the indicators.

An investigator must still examine whether the proposed relationships are supported by evidence.

The problem becomes more difficult when an organization produces large volumes of low-value alerts.

Every irrelevant alert competes for attention.

Every unnecessary investigation consumes resources that could be spent examining more consequential activity.

And every poorly tuned detection can contribute to an environment in which analysts begin treating potentially important signals as routine background noise.

This does not mean that less data is always better.

Insufficient logging creates serious investigative problems.

The objective is not to minimize information.

It is to maximize the evidential value of the information available.

Because information that cannot support a meaningful decision may contribute more to operational complexity than to security.

The Human Brain Was Never Designed to Investigate Infinite Alerts

Technology is only part of this paradox.

The other part is human cognition.

Cybersecurity analysts are expected to evaluate complex evidence under conditions of uncertainty, time pressure, and operational risk.

They must identify malicious activity while minimizing unnecessary disruption.

They must distinguish genuine threats from routine behaviour.

And they must often make decisions using incomplete information.

Yet human attention is limited.

Working memory is constrained. Judgment is influenced by previous experiences, expectations, fatigue, and cognitive biases.

Daniel Kahneman's work in Thinking, Fast and Slow provides a useful conceptual lens.

Nobel laureate Daniel Kahneman explored how intuition, cognitive biases, and deliberate reasoning influence human judgment.

Kahneman describes fast, intuitive thinking and slower, more deliberate analytical thinking.

These are explanatory constructs rather than separate physical systems within the brain, but they illuminate the kinds of cognitive processes involved in security investigations.

Imagine an analyst who has investigated hundreds of alerts generated by a particular rule.

Most were false positives.

Over time, the analyst begins expecting the same outcome.

When another alert appears, familiar reasoning takes over.

The event resembles previous false positives.

The rule has a poor reputation.

Other alerts require attention.

The analyst closes it.

Perhaps the decision is correct.

But perhaps this particular event represents the beginning of a genuine intrusion.

The important point is not that analysts are careless.

It is that repeated exposure to low-value information can influence the way evidence is interpreted.

There is also confirmation bias.

An analyst who believes an event is harmless may emphasize evidence that supports that conclusion.

An analyst convinced that an attack is occurring may interpret ordinary system activity as proof of compromise.

Both can reach incorrect conclusions while examining accurate telemetry.

This is why investigation should not merely involve accumulating evidence that supports an initial suspicion.

It must include actively looking for evidence that could challenge it.

A useful investigative question is not simply:

What evidence supports my hypothesis?

It is:

What evidence would cause me to reject my hypothesis?

That question brings us toward Karl Popper's philosophy of falsifiability.

Popper argued that scientific theories should be open to meaningful tests that could potentially refute them.

Security investigations are not identical to controlled scientific experiments. Nevertheless, the underlying discipline is valuable.

If an analyst believes an account has been compromised, the investigation should consider alternative explanations and identify observations that would strengthen or weaken each possibility.

The objective is not to defend the first plausible explanation.

It is to arrive at the most defensible conclusion.

OSINT: When Finding Information Is Mistaken for Discovering Truth

The surveillance paradox also exists outside traditional security operations.

It is particularly visible in Open-Source Intelligence (OSINT).

Today, investigators can retrieve extraordinary amounts of publicly accessible information.

Historical DNS records, archived websites, domain registrations, exposed services, corporate information, code repositories, social media accounts, and metadata can all contribute to an investigation.

But obtaining information is only the beginning.

Suppose an investigator discovers that two domains share historical registration information.

Another domain has appeared on the same IP address.

Several websites reference the same email address.

A collection of archived pages contains an identical tracking identifier.

Taken together, these observations may suggest an association.

But what exactly has been established?

Shared infrastructure does not necessarily prove common ownership.

Historical registration data does not establish present-day control.

An email address may belong to an administrative intermediary.

A tracking identifier may have been reused through copied templates.

And even a confirmed technical relationship does not establish criminal intent.

This is why OSINT must distinguish between observation, association, inference, and attribution.

Each requires a different level of evidential support.

A visually impressive relationship graph can be misleading when its connections are based on weak assumptions.

In fact, the more interconnected the graph appears, the more convincing the resulting narrative can become.

Human beings are naturally inclined to recognize patterns and seek explanations that connect fragmented observations.

That tendency can be useful.

It can also mislead us.

A coherent narrative is not necessarily a correct narrative.

The objective of intelligence analysis should never be to construct the most convincing story.

It should be to construct the explanation that survives the strongest scrutiny.

This is where OSINT moves beyond search techniques and becomes an exercise in epistemology.

The serious investigator must continually distinguish what is known, what is probable, what is merely possible, and what remains unsupported.

The Dashboard as Plato's Cave

There is another philosophical dimension worth examining.

Plato's The Republic and the Allegory of the Cave.

In Book VII of The Republic, Plato describes prisoners confined within a cave.

They observe shadows projected onto a wall and mistake those shadows for the entirety of reality.

The allegory challenges the relationship between appearance, knowledge, and the process of discovering what lies beyond immediate perception.

Consider how cybersecurity professionals experience their environments.

Most of the time, we do not directly observe the underlying reality of our networks.

We observe representations.

SIEM dashboards.

EDR status indicators.

Risk scores.

Threat intelligence summaries.

Attack surface inventories.

Compliance percentages.

These representations help us manage complexity.

Without them, modern cybersecurity operations would be significantly more difficult.

But every representation is constructed.

Someone determines what information should be collected.

Someone defines the detection conditions.

Someone selects the scoring methodology.

Someone establishes the thresholds.

Someone decides what should appear on the dashboard.

The result is a model of reality shaped by assumptions, measurement limitations, and design choices.

A green dashboard does not necessarily mean the environment is secure.

A lower risk score does not automatically prove that the organization has become safer.

Fewer alerts do not necessarily indicate fewer attacks.

The monitoring pipeline may have stopped reporting.

A critical system may have fallen outside the asset inventory.

An attacker may have shifted activity into infrastructure without suitable sensors.

Or a scoring model may be rewarding measurable improvements while overlooking emerging risks.

A representation of security is not security itself.

The danger begins when the representation becomes more authoritative than the reality it is supposed to describe.

Like the prisoners in Plato's cave, we may become so accustomed to interpreting the shadows that we stop questioning what produces them.

Artificial Intelligence May Accelerate the Paradox

Artificial intelligence introduces a new dimension to this problem.

AI-assisted security operations can help correlate events, summarize incidents, enrich alerts, and accelerate investigations.

These capabilities can improve operational efficiency.

But they also introduce a risk when fluent automated explanations are treated as verified conclusions.

Imagine an AI assistant analyzing several related alerts.

It generates the following summary:

An external attacker compromised a privileged account, executed lateral movement, and attempted data exfiltration.

The statement sounds technically credible.

But what evidence supports each conclusion?

Was the privileged account actually compromised?

Did the observed activity establish lateral movement?

Was the data transfer unauthorized?

What alternative explanations were considered?

What evidence was missing?

A well-written summary can conceal weak reasoning.

A confident explanation can make uncertainty less visible rather than eliminate it.

This is especially concerning because humans may place disproportionate confidence in outputs that appear authoritative, coherent, and technically sophisticated.

The danger is not simply that an AI system might hallucinate.

It is that an analyst might accept an unverified interpretation because it resembles the conclusion an expert would produce.

At that point, AI does not merely accelerate investigation.

It can accelerate the acceptance of questionable assumptions.

This is why AI-assisted cybersecurity must preserve evidence provenance and uncertainty.

An analytical system should allow investigators to examine its supporting observations, distinguish facts from inferences, evaluate conflicting evidence, and understand the limits of its conclusions.

A useful AI system should not merely answer what happened.

It should also help answer why do we believe that happened.

And perhaps more importantly what would make us reconsider that conclusion.

The objective should be augmented judgment, not automated certainty.

The SyberSeeker Intelligence Interpretation Ladder

If visibility alone is insufficient, how should we approach the problem differently?

I propose a conceptual model called the SyberSeeker Intelligence Interpretation Ladder.

It represents five analytical capabilities involved in transforming raw observations into defensible security decisions.

This is not intended to replace established intelligence-analysis methodologies, incident-response frameworks, or threat-hunting processes.

It is a conceptual aid for examining where understanding is gained, weakened, or lost.

Level 1. Observation: What Was Recorded?

The first stage concerns the collection of reliable evidence. Security teams need to determine whether relevant events are being captured, whether sources can be trusted, and whether important blind spots exist. An incomplete observation can distort every subsequent analytical stage.

Level 2. Context: What Surrounds the Event?

An event gains meaning from its circumstances. An administrative command may be ordinary during scheduled maintenance but suspicious when executed by an unfamiliar account outside approved procedures. Context includes identities, assets, business functions, system behaviour, timing, and authorization.

Level 3. Correlation: How Do the Signals Connect?

Correlation identifies relationships across events, sources, and time. An authentication event, process execution, and outbound transfer may form a meaningful sequence. However, temporal or technical association alone does not establish causation. The relationships must be tested.

Level 4. Interpretation: Which Hypothesis Best Fits the Evidence?

This stage requires analytical reasoning. Investigators evaluate competing explanations, identify contradictory evidence, assess uncertainty, and determine which hypothesis is best supported. This is where cybersecurity moves beyond event processing into intelligence analysis.

Level 5. Judgment: What Action Is Justified?

The final stage translates understanding into operational decisions.

Should an account be disabled?

Should a system be isolated?

Is there sufficient evidence to declare an incident?

Would further investigation produce information valuable enough to justify delaying containment?

These decisions require technical evidence, risk assessment, business context, and an understanding of uncertainty.

An Important Principle: The Ladder Is Not Linear

Although the model illustrates five progressive levels, actual investigations are iterative.

New evidence may invalidate an earlier interpretation.

Missing context may require additional collection.

A proposed response may reveal assumptions that need to be tested.

Throughout the process, analysts should continuously assess evidence provenance, data completeness, alternative explanations, and confidence.

The most important analytical achievement is not always reaching the top of the ladder.

Sometimes it is recognizing that the available evidence does not justify proceeding further.

There is intellectual discipline in saying:

We do not know yet.

We Need Better Questions, Not Just Better Dashboards

There is a recurring pattern in technological development.

When confronted with complexity, we often respond by increasing our capacity to process information.

If monitoring is incomplete, we deploy more sensors.

If correlation is difficult, we introduce automation.

If investigation is slow, we add artificial intelligence.

These improvements can be necessary.

But they do not eliminate the need to question whether our methods are producing meaningful understanding.

The most important question for a SOC may not be how many alerts it processed today.

It may be how effectively it distinguished genuine threats from irrelevant activity.

The most important question for an OSINT investigator may not be how many digital footprints were discovered.

It may be how confidently the relationships between those footprints can be established.

The most important question for a cybersecurity executive may not be whether every dashboard appears healthy.

It may be whether the organization understands the assumptions, weaknesses, and blind spots behind those indicators.

This perspective aligns with the broader risk-management orientation of NIST SP 800-61 Revision 3, which emphasizes integrating incident response throughout cybersecurity risk management.

Detection has little operational value if it cannot lead to informed action.

Similarly, monitoring coverage should not be evaluated independently of detection quality, investigative capability, response effectiveness, and evidence reliability.

Security maturity is not defined simply by how much an organization can observe.

It must also consider how effectively the organization can explain what those observations mean.

We therefore need a culture that rewards reasoning rather than activity.

One that values evidence quality over information volume.

One that challenges assumptions instead of accepting automated conclusions.

And one that recognizes uncertainty as something to be managed rather than concealed.

The Final Paradox

There is something deeply ironic about modern cybersecurity.

We have spent decades expanding our technological ability to observe digital environments.

We have developed monitoring platforms, automated detection systems, predictive models, threat intelligence services, and increasingly sophisticated artificial intelligence.

Yet none of these capabilities automatically guarantees understanding.

Michel Foucault helped us understand surveillance as a mechanism of power and behavioural influence.

Plato challenged the relationship between appearance and reality.

Daniel Kahneman examined how human judgment can be shaped by cognitive shortcuts and biases.

Karl Popper emphasized the importance of exposing explanations to meaningful tests.

Together, these perspectives reveal something important about cybersecurity.

The quality of our understanding depends on more than the amount of information available.

It also depends on how that information was produced, which assumptions shape its interpretation, what alternative explanations remain plausible, and whether our conclusions can withstand scrutiny.

The Change Healthcare incident reminds us that technical acceptance of an identity does not necessarily establish legitimate authority.

Mandiant's findings remind us that sophisticated monitoring systems can coexist with substantial blind spots.

OSINT investigations remind us that discovering digital associations is not the same as proving what those associations mean.

And the growing use of AI reminds us that fluent explanations are not substitutes for verifiable reasoning.

I do not believe we should abandon surveillance technologies.

We need reliable telemetry, comprehensive monitoring, intelligent correlation, and capable analytical systems.

But we must stop confusing these capabilities with understanding.

Because there is a difference between watching an event unfold and recognizing its significance.

A difference between collecting evidence and knowing what it proves.

A difference between constructing a convincing explanation and establishing a defensible conclusion.

Information is not knowledge.

Correlation is not causation.

Visibility is not comprehension.

And surveillance is not security.

Perhaps the real maturity of cybersecurity begins when we stop asking how much of our environment we can observe and start asking how much of what we observe we genuinely understand.

After all, we have become extraordinarily good at watching our digital world.

But have we become equally good at understanding it?

See you in the next blog post. Tschüss :-)