From Signals to Decisions: What We Shared at Infosecurity World Florida | SecurityHQ

Attackers now move from disclosure to exploitation in hours, and from intrusion to exfiltration in about an hour. That was the message from SecurityHQ’s session at Infosecurity World in Florida, held 12th to 14th October 2026.

On 13th October, Alan Cizenski, our Head of Product and Services, took to Tech Theater Stage 1 to present Closing the Real Speed Gap: Building Security Ecosystems for Faster Security Decisions. He was joined at the event by colleagues Marc Beaudin, Mathew Cancel and Dylan Burnett, with our presence organised by Rita Smith and Jessie Shabin.

Here are the key takeaways from the session.

Attackers win through speed and scale, not sophistication

Alan opened with a frustrating truth: attackers aren’t necessarily more sophisticated than before. They are winning through brute speed and scale, enabled by AI.

Three forces are driving this:

• Preventable gaps. 90% of breaches begin in exposure, such as limited visibility, inconsistent controls, unmanaged assets and permissive identity. Preventable doesn’t mean easy, especially when teams are prioritising thousands of exposures across a cloud estate that never stops changing.
• Supply chain sprawl. Your attack surface is no longer just what you own. Every vendor connection, SaaS integration and inherited permission expands exposure in ways that are hard to discover.
• Faster exfiltration. In 2025, the fastest 25% of intrusions reached exfiltration in 72 minutes, down from 285 minutes in 2024.

The result is that security teams must understand more risk, across more complexity, with barely an hour to make the right call.

The exploitation window is now measured in hours

The 2025 React2Shell vulnerability showed how short the window has become. Rated CVSS 10.0, it saw exploitation activity within hours of disclosure as threat actors raced to find and target exposed systems.

The timeline Alan walked through looks like this:

1. 00:00 – CVE announced. Vulnerability details become public.
2. 00:15 – Scanning begins. Within 15 minutes, attackers are identifying exposed systems.
3. Hours later – Exploitation. Vulnerable targets are actively attacked.

The patching window is no longer measured in days. Teams need to know whether they are exposed almost as soon as a vulnerability is disclosed.

Why one security decision needs so many signals

To make a single, well-informed security decision, teams need context from many sources: threat intelligence, vulnerability data, asset criticality, cloud telemetry, identity activity and business context. Is the asset touching customer data, or is it a development server? Is the vulnerability being actively exploited, and by whom?

The problem is that these signals live in different systems, use different formats, belong to different teams and change constantly. Correlating them means defining the relationships between them in advance, and that doesn’t scale:

• There are too many signals to correlate manually.
• There are too many relationships to define in advance.
• Rules need continuous maintenance.
• Context changes faster than logic can be updated.

What teams are left with is disconnected signals that never add up to one clear picture.

The architecture of AI-powered decision-making

Alan was clear that this isn’t about reinventing the wheel. It follows the way a security operations centre already works. The difference is that AI accelerates the manual, repetitive and time-consuming steps, and enforces a consistent standard so no step is missed.

1. Data ingestion. Rather than relying solely on SIEM alerts, telemetry is brought together from cloud, identity, endpoint, network, threat intelligence and other operational sources.
2. Triage. Before an analyst sees an alert, AI removes duplicate events, suppresses routine activity and filters out noise. In SecurityHQ’s own research, this approach improved the signal-to-noise ratio by 62%.
3. Enrichment. AI correlates activity across sources, connecting detections with vulnerability data and asset context. Where context is missing, it goes and hunts for it.
4. Investigation. Instead of isolated events, analysts get an incident storyline that shows what is happening and why it matters.
5. Containment. With context in place, analysts decide sooner and contain faster, focusing where they will have the greatest impact.

Every investigation then feeds back into the system. Detections become more accurate, playbooks more effective and the baseline keeps improving. Attackers may be moving faster than ever, but defenders can now get smarter faster than ever too.

Getting started: build, buy or partner

Automated context generation is something every security organisation now needs to work towards. Alan outlined three realistic paths, each with its own trade-offs.

Whatever the route, signal quality decides the outcome. Accurate context depends on well-configured, continuously optimised tools and detections refined across thousands of environments. As Alan put it, garbage in, garbage out still applies. The right choice depends on your resources and risk tolerance.

Closing the speed gap: from signals to decisions

For 20 years, the industry has invested in collecting data, building tools and writing detections. Generating alerts is something security teams do well. But collecting signals was never the goal. The goal has always been better, faster security decisions.

AI is a tool for defenders as much as for adversaries. Its real value isn’t replacing analysts; it’s delivering unified context. That means automatically correlating signals across your environment, seeing real risk earlier in the threat lifecycle and making faster decisions with full context. Each of those buys back time in a shrinking window.

Thank you to everyone who joined Alan’s session and stopped by to speak with Marc, Mathew and Dylan. If you’d like to explore how faster, context-driven decisions could work in your environment, talk to our team.