What are the sources that reveal an intrusion your SOC never alerted on?

## Misses do not arrive through the queue The alert queue only contains things that fired. An intrusion nobody detected is, by construction, absent from it, so learning about a miss always means learning it from somewhere else. There are four such channels, and knowing their individual blind spots matters more than being able to list them. ### 1. Outside notification Somebody external tells you: an information-sharing organisation, a national CERT or law-enforcement contact naming your data or your address ranges, an upstream or downstream partner, a customer who noticed something, a researcher, a hosting provider, or the intruder themselves via an extortion note or a leak-site posting. *What it finds:* intrusions with a consequence visible outside your estate — data that surfaced somewhere, infrastructure that appeared in someone else's telemetry, fraud that landed on a balance sheet. *What it is blind to:* everything that stayed quiet. An intrusion whose objective was long-term access, or whose stolen data was never published or resold visibly, produces no outside signal at all. ### 2. Authorised adversary emulation Someone executes chosen behaviours against the live estate under authorisation, and you observe whether telemetry appeared, whether a rule matched and whether a case was worked. *What it finds:* misses of the specific behaviours that were chosen, with an exact timestamp, which makes each one immediately actionable. *What it is blind to:* behaviours nobody chose. The technique list is written by your team from what your team already thinks about, which is precisely the population whose gaps you are trying to discover. ### 3. Hunting An analyst forms a hypothesis about activity that would be present if a particular kind of intruder were in the estate, and searches for it without an alert to start from. *What it finds:* activity that is present in your retained data and that someone thought to look for. *What it is blind to:* anything outside retention, anything in a source you never collected, and any hypothesis nobody formed. ### 4. The back-timeline of a later intrusion While scoping a confirmed intrusion you walk backwards through logs and find earlier activity — sometimes an alert that fired months ago and was closed as a false positive, sometimes activity that never alerted at all. *What it finds:* misses adjacent in host, account or technique to something you eventually caught. *What it is blind to:* misses that never led to anything you detected later. It is conditional on a subsequent success, which is exactly the wrong condition for measuring failure. ## The composite blind spot Put the four blind spots together and a specific shape of intrusion is invisible to all of them at once: slow, using tooling the estate already sanctions, producing no external consequence, not matching any behaviour on an emulation list, and never escalating into an incident that would be reconstructed later. The worked case is a months-long slow-drip exfiltration through the corporate file-sync client in a SaaS tenant. The client is approved and installed everywhere. The audit trail shows downloads and shares that are indistinguishable, record by record, from a busy salesperson. No rule fires because no rule describes it, no analyst opens a case, the volume never spikes, nothing leaves through a channel anyone watches, and the data is never published. All four channels return nothing — and would keep returning nothing indefinitely. ## The channel table | Channel | Finds | Blind to | | --- | --- | --- | | Outside notification | intrusions with an external consequence | quiet intrusions with no outside footprint | | Emulation | misses of the behaviours you chose | behaviours nobody put on the list | | Hunting | activity in retained data you thought to query | unretained sources, unformed hypotheses | | Back-timeline | misses adjacent to a caught intrusion | misses that never led to a later detection | ## What this means for a small team A one-analyst team with no emulation programme and no hunt cadence has channels 1 and 4 only. Both require the intrusion to eventually become consequential — someone outside notices, or it grows into an incident that gets reconstructed. So its recorded misses are not merely few; they are systematically shaped, containing only intrusions that ended loudly. When such a team reports its known misses, the correct caption is `these are the ones that became visible to somebody`, and the highest-value structural fix is to open a channel that does not depend on the intrusion becoming loud. ## A fifth case worth separating An alert that fired and was never worked — sitting unopened in a backlog — is also a miss, but it is the one kind that left a record. Keep it in a separate count: the detection succeeded and the process failed, and the remedy is queue capacity or routing, not new coverage. Blending it into the coverage numbers makes teams build rules to solve a staffing problem.