The strongest objection first
Take the case against seriously, because it is good. A detection engineer does not need a theory of emergence to explain the ninety-day exposure window. CVE-2023-whatever is disclosed on a Tuesday. The internal audit cycle runs quarterly. For up to ninety days, a service that everyone now knows is vulnerable sits reachable, because nobody re-scanned the estate since the last pass and nobody will until the next one. That is not a failure of observational window. That is a scheduling failure. Fix the cadence — scan weekly, or on every disclosure, or continuously with off-the-shelf agents — and the gap closes. No new category of intake is required. No Large Universe Model, no continuous-stream architecture, no provenance ledger. Just a shorter interval between checks that already exist. The objection writes itself: cybersecurity's problems are budget and cadence problems wearing a systems-theory costume.
This deserves to be taken at face value before it is answered, because a great deal of security tooling genuinely is a cadence problem, and no amount of talk about emergent regularities should be allowed to obscure that. Most exposure windows close with money and process, not epistemology.
Where the objection holds
Grant it fully for the disclosure-to-patch gap itself. A published CVE is, by definition, already named, dated, and scored. It is the closest thing security has to Belousov's reaction written up in a journal — the pattern has been seen, described, and handed over. Detecting that a given host runs the vulnerable library version is a substrate-level fact, checkable by a scanner reading package manifests. No higher-level regularity needs to be caught in the act; the regularity was caught already, by whoever filed the CVE, and the task left is inventory matching. A faster audit cycle, better asset inventory and automated patch orchestration solve this cleanly. This is the domain's Large Language Model layer working as intended: a frozen corpus of known-bad signatures, matched against a scene. It is genuinely sufficient for a large share of the exposure problem, and pretending otherwise would be dishonest.
Where it stops holding
The concession does not travel to the cases that actually keep detection engineers awake, which are not "known vulnerability, unpatched" but "novel behaviour, unnamed."
Consider lateral movement built from entirely legitimate administrative tools — a pattern security researchers now file under living-off-the-land technique, but which for years had no name, no signature, no line in any corpus, because each individual action (a scheduled task, a WMI call, an SMB session) is something a sysadmin does daily for benign reasons. No malware corpus contains it, because it isn't malware. No single disclosure feed names it, because it isn't a vulnerability. The pattern exists only at the level of a sequence: this account, which has never touched this host, authenticating at 03:14, then enumerating shares, then touching a domain controller, all within four minutes, echoing a shape seen across a dozen prior incidents that were only linked in retrospect. That shape is emergent in the strict sense: absent from the vocabulary of any single event log line, present only in the correlation across telemetry streams held long enough to see the sequence recur.
A scanner checking package versions against a disclosure feed cannot see this, no matter how often it runs. The problem was never cadence. The regularity a detection engineer needs is not written down anywhere before it happens for the first time in this estate, and it will not sit still inside any bounded window of collection — it depends on comparing this week's authentication graph against a baseline built from months of prior sessions, and it depends on configuration drift logs, EDR telemetry, and identity provider events all correlating together, continuously, with enough history behind them to know what "never touched this host" actually means.
The two objections that matter here
Emergence may just be epistemic — a big enough model over the substrate could derive it. Granted where derivation is genuinely available: statistical mechanics recovering temperature from kinetics is a real derivation, because thermometers told physicists what macrovariable to solve for. Security has no equivalent oracle. Nobody derives "credential-stuffing campaign against this identity provider, staged over six weeks to stay under per-account lockout thresholds" from packet captures by brute-force search over the space of candidate aggregates; the space is unbounded, and the attacker is actively varying pace and vector specifically to avoid falling into a substrate-level signature. The macrovariable — a coordinated campaign identity — is historically contingent on this attacker's tooling and this defender's thresholds. It has to be watched into existence, across authentication logs, geolocation feeds and rate-limit telemetry held long enough to see the stretching-out. There is no shortcut to derivation here; observation is the only route, which is exactly the source material's narrow claim and exactly the shape of a modern credential attack.
Downward causation is metaphysically suspect; lean on constraint instead. Correct, and cybersecurity gives constraint a very literal reading. An organisation's segmentation policy, its identity boundary, its detection thresholds — these are boundary conditions set at the organisational level, and they select which micro-events are even possible for an attacker to execute without tripping a control. A firewall rule does not violate TCP; it fixes which packets exist on the wire at all. When those boundary conditions themselves drift — a firewall rule quietly loosened during an incident and never tightened back, a service account granted temporary elevated access that nobody revoked — the substrate record alone is uninformative, because the same packet, the same authentication event, means something different depending on which policy state generated it. A log of raw events without a parallel record of the policy history is underdetermined. This is configuration drift in its precise sense, and it is exactly why the intake needs provenance, not merely volume: a belief about "this access is anomalous" has to carry with it when the access-control state was last known and by what mechanism, so that it can be revised or retired when the boundary condition changes again.
More streams just mean more false positives. An always-on system watching disclosure feeds, telemetry, malware corpora and configuration drift simultaneously will drown a detection team in coincidental correlations. Intake was never the bottleneck. Analyst triage capacity is.
This is the strongest of the three standard objections and it is largely right about the mechanism, wrong about the remedy. Breadth of intake does inflate the space of spurious aggregate correlations — two unrelated services restarting near-simultaneously across a large estate will happen constantly by chance. But the corrective to that inflation is more continuity, not less: a spurious correlation between service restarts dissolves the next time the pattern fails to recur under a different load profile, whereas a genuine emergent attack pattern — the lateral-movement shape, the slow-burn credential campaign — persists and recurs across changing conditions precisely because it reflects something structural about the attacker's method. A disclosure feed frozen at a point in time cannot run that persistence test; it has no "next time." Provenance is what lets the discipline actually work in practice: a belief tagged with which sensor produced it, when, and under what confidence, can be down-weighted or retired as evidence accumulates, rather than argued about by committee. Continuous intake does not replace triage. It is what makes triage tractable at all, by supplying the history against which a candidate pattern can be tested rather than merely noticed once.
The narrower claim
None of this rescues a maximal thesis. Most exposure windows in a real estate close through unglamorous means: faster patch cadence, better inventory, cleaner ownership of assets. A detection engineer who spends the ninety days improving scan frequency is doing legitimate, high-value work, and no talk of emergence should be read as a criticism of that work.
What continuous, provenance-carrying intake earns is narrower and real: the capacity to catch the behaviour that is legitimate in isolation and only anomalous as a sequence, held together across streams and time long enough for the shape to repeat, with a record good enough to say when the underlying boundary conditions themselves last shifted. That is not a bigger corpus and it is not a wider sensor on a fixed scene. It is a different relationship to time — the thing the ninety-day gap was a symptom of all along.