The dwell-time problem
A SOC analyst runs a threat hunt on Tuesday. The hunt is thorough: EDR telemetry pulled, identity logs cross-referenced, a threat intel feed checked against observed indicators. The hunt finds nothing, and the finding is correct, given what was in front of the analyst. The intrusion begins Wednesday afternoon, using a credential harvested from a phishing kit that went live six hours after the hunt closed. It dwells until the next scheduled hunt, eleven days later. Median dwell time across the industry sits somewhere in the range of days to weeks depending on sector and whose telemetry you trust; the number that matters here is not the average but the mechanism. The gap is not an error in the Tuesday hunt. The gap is the interval itself. Evidentialism has a precise name for what happened: the analyst's belief that the environment was clean was justified by the evidence possessed on Tuesday, and that evidence expired on Wednesday without anyone being told.
This is the shape of the problem in security operations specifically. Threat, identity and configuration are not stable objects periodically observed. They are streams. Treating a stream as a snapshot is the recurring failure mode, and it recurs regardless of how good the snapshot is.
What arrives
Four kinds of evidence arrive continuously, on different clocks.
EDR telemetry arrives near-real-time: process creation, network connections, registry writes, memory-resident behaviour, typically streamed in seconds. Threat intelligence arrives in bursts: an indicator-of-compromise feed update, a vendor advisory, a CVE disclosure, each dated and each with its own half-life — an IP-based indicator may be useless within 48 hours, a TTP-based one may hold for months. Identity events arrive as a log of discrete actions: authentications, privilege grants, token issuance, each timestamped and each capable of retroactively changing the meaning of something already logged. Configuration drift arrives slowest and matters most when ignored: a firewall rule loosened for a vendor integration, a service account granted a permission during an incident and never revoked, a patch deferred past its window.
None of these streams pauses. A frozen ingestion — pull the feeds once at shift start, work from that — is the equivalent of the Large Language Model's cutoff: a well-reasoned position on a world that has already moved by the time reasoning happens. A bounded hunt — pull everything relevant to a specific scene, a specific host, a specific incident window — behaves like a Large World Model: excellent evidence while the scene is open, and nothing revisable once the ticket closes. Security operations at scale cannot run on either. The loop has to hold evidence the way it arrives: continuously, with the clock attached.
What is held
Not everything arriving is retained in the same way, and the distinction matters more than the volume.
Raw telemetry is retained for a bounded window, commonly 30 to 90 days hot, longer cold, because retention is expensive and most of it will never be queried again. What is retained indefinitely, in a different structure, is the belief state built from that telemetry: this host is compromised, this account is anomalous, this rule is a drift from baseline. Each belief carries provenance — which sensor, which feed, which analyst action produced it, and when — and a decay function appropriate to its type. A belief sourced from a single low-confidence IOC match decays fast. A belief sourced from confirmed lateral movement, corroborated across EDR and identity logs, decays slowly and requires an explicit event to retract.
This is the structural feature that separates a security data lake from a security evidential state. A data lake holds records. An evidential state holds dated claims about the world, each claim tagged with what would have to happen to overturn it.
What triggers revision
Revision is not scheduled. It is triggered by specific events, and naming them concretely is the difference between a working loop and a compliance exercise.
- A new IOC match against retained telemetry: a domain flagged today matches a DNS query logged three weeks ago. The belief "host X was clean in that window" is retracted retroactively, and everything reasoned from it downstream — a closed ticket, an unblocked account — is flagged for review.
- An identity event that reclassifies a prior one: an account behaving oddly on Monday is explained on Thursday by a legitimate but undocumented automation script. The anomaly belief downgrades; the drift belief on the undocumented script goes up.
- A configuration scan that finds a control has silently failed: an EDR agent reporting healthy while actually not forwarding events for six days. Every belief built on that agent's silence — "no alerts, therefore no incident" — is void from the moment the gap is detected, not from the moment it started.
- Threat intel supersession: a vendor retracts an attribution, or a CVE initially scored as low severity is rescored after a working exploit surfaces. Beliefs derived from the old score are re-weighted without re-running the whole hunt from scratch.
Each trigger does the same job: it locates a belief whose justification has expired and forces the system to say so, rather than letting the stale belief sit unmarked next to current ones.
What the analyst sees
The interface consequence is specific and testable: nothing in the working view is presented as flat fact. Every belief carries its age, its source chain and its confidence trajectory. "No indicators of compromise on host X" renders differently depending on whether that finding is six minutes old, sourced from three corroborating streams, or six days old, sourced from a single feed that has since had an update pending. An analyst working from a system with genuine continuous intake sees a queue prioritised not by severity alone but by staleness-weighted severity: a moderate finding whose supporting evidence is fresh can rank above a severe finding resting on evidence that has drifted past its reliable window and is due for re-confirmation.
This is where evidentialism stops being a philosophical nicety and becomes an operational rule. Justification is dated. A dashboard that shows the analyst a belief without its age is asking them to reason as if evidence does not expire, which is exactly the defect a frozen corpus has and a continuously revised evidential state does not.
What it costs
The objection with the most force here is the cost one, and security operations feels it directly.
Ingesting every stream at full fidelity, reconciling contradictions across sensors, and retaining provenance for months is expensive in storage, compute and analyst attention. A curated, smaller feed — known-bad indicators, high-confidence alerts only — may produce fewer false positives and better-justified action than a firehose that buries the analyst in noise.
This is correct as far as it goes, and alert fatigue is the concrete cost the objection is naming: a SOC drowning in 10,000 low-fidelity alerts a day reasons worse than one working from 200 well-triaged ones, whatever the raw evidential completeness of the larger set. But the reply holds. Provenance is not an add-on to volume; it is what makes volume tractable. A system that retains which sensor produced a signal and that sensor's historical false-positive rate can down-weight a noisy source automatically, which a merely curated snapshot cannot do because it has already discarded the material needed to make that judgement. The cost is real and it constrains what gets retained at what fidelity for how long. It does not license going back to a frozen or scene-bound intake, because the failure mode of dwell time is worse than the failure mode of noise, and only continuous, provenance-tagged intake addresses both at once.
The second objection worth taking seriously is the reliabilist one:
Justification might depend on the alert-generation process being reliable, not on the analyst surveying evidence directly. A well-tuned detection rule can justify escalation even if nobody articulates the underlying evidence.
True, and detection engineering runs on exactly this logic. But a detection rule is reliable only relative to the adversary behaviour it was tuned against. A rule built on 2023 lateral-movement patterns degrades against a 2025 living-off-the-land technique it was never trained to see; it does not become unreliable all at once, it becomes quietly less reliable, in a way indistinguishable from the frozen-corpus problem in different clothing. Reliabilism, applied honestly to a moving adversary, ends up demanding the same thing evidentialism demands directly: a currency requirement, met only by a loop that keeps checking whether the rule still fits the world it is watching.
Why the loop cannot go further
There is no fourth stage to add. A SOC can improve coverage — more sensors, more identity providers instrumented, faster feed updates. It can improve calibration — better decay functions, better provenance weighting, less alert fatigue. None of that is a new kind of evidence. It is the same kind, arriving faster, weighted better, retained longer. The dwell-time problem is not solved by a bigger hunt scheduled more often; it is dissolved by removing the concept of "between hunts" altogether, so that the evidential state possessed at 3am on a Sunday is the evidential state available at 3am on a Sunday, with nothing held back for the next scheduled look.