Changing technical requirements
A corporate or government security team in 2014 detected attacks mainly with signature-based tools, which matched traffic against a store of known indicators of compromise IR1. Attackers who used a new tool, or changed a known one, passed through those defenses, and many significant breaches came that way IR1. Log management systems collected the alerts but struggled to analyze behavior across current and historical data at the scale required IR1. Teams in the same industry could share notes through information-sharing groups, but those groups relied on signature-based feeds and on email between analysts who knew each other, so warnings arrived late and lacked specifics IR1. Analysts were too few for the alerts they already had IR1.