A conference paper and a failing curve
In 1973, at a Carnegie-Rochester conference, Robert Lucas presented a critique that would take three years to reach print and a decade to remake macroeconomics. The immediate target was concrete: large Keynesian models, some running to hundreds of simultaneous equations, used by governments and central banks to simulate the effects of tax changes, interest rate moves, spending programmes. Through the 1960s these models had fitted reasonably well. Through the 1970s, as inflation accelerated, they broke. The Phillips curve — the estimated trade-off between unemployment and inflation — stopped describing the trade-off.
Lucas's explanation was not that the statisticians had made an error. It was that the coefficients were never structural in the first place. They described how firms and workers had learned to set prices and wages under a specific policy regime: low, stable inflation, a central bank that behaved in a particular predictable way. Change the policy — try to exploit the historical trade-off by deliberately running higher inflation — and expectations adjust. Workers start bargaining for wage increases that anticipate the inflation rather than reacting to it after the fact. The old curve, which looked like a law, was the residue of a regime. Fit is not invariance. A model estimated on historical data cannot tell you which of its relationships will survive a change in the conditions that generated them, because it was never shown a change.
The same shape, watched at machine speed
A Security Operations Centre runs on the same kind of estimated relationship, compressed from years to weeks. A detection rule — a threshold on process spawning behaviour, a baseline for what "normal" authentication from a given identity looks like, a scoring model that ranks EDR alerts by likely severity — is fitted on a window of prior telemetry. That window encodes a regime: which lateral movement techniques were in favour, which cloud identity provider quirks produced benign false positives, which third-party software normally reached out to which domains. The rule looks like a law of intrusion. It is a description of adversary behaviour under the conditions that prevailed while the training telemetry was collected.
The regime changes constantly, and usually invisibly to the rule itself. An attacker group shifts from custom malware to living-off-the-land binaries because EDR vendors got good at flagging the malware. A SaaS provider changes its default authentication flow, and every account suddenly triggers the impossible-travel rule that used to mean compromise. A vendor patches a library, config drift creeps into baseline images, a merger brings in ten thousand identities with a different provisioning pattern. None of this is noise around a stable relationship. It is the relationship moving. The detection model, like the Phillips curve, keeps producing scores with the same confidence, on a mapping that no longer holds.
The characteristic failure of a SOC is not a missed alert. It is dwell time: the interval between a genuine intrusion beginning and the point at which a human, usually a SOC analyst on a scheduled threat hunt, notices the pattern the automated rules were fitted to miss. Industry dwell-time figures have hovered in the range of one to several weeks for years, not because analysts are slow, but because the structural relationship the detection stack relies on has already shifted by the time the hunt happens. The hunt itself is a discrete sample — a scene, in effect — taken against a process that has kept moving between samples.
Intake as the actual variable
This is not a story about better rules. It is a story about what the system is allowed to look at, and when. A rule trained once, on a corpus of past telemetry, and then frozen into a detection signature, is structurally identical to a macroeconometric model estimated on a decade of pre-1970s data: accurate about a regime, silent about the fact that it is a regime, and confident regardless.
| generation | intake in security operations | what fails |
|---|---|---|
| Large Language Model | a corpus of threat reports, CVEs and incident writeups, frozen at a training cutoff | treats last year's TTPs as current; cannot see this week's campaign |
| Large World Model | live telemetry during a bounded window — a hunt, an incident response engagement | sees the present scene accurately, but the scene ends and the regime keeps moving between engagements |
| Large Universe Model | EDR telemetry, threat intel feeds, identity events and configuration drift, all streaming continuously, with each belief timestamped and dated for revision | dwell becomes visible as it opens, not after the next scheduled hunt |
A model built like a Large Language Model in this domain is the analyst's static playbook: a set of indicators of compromise and detection logic assembled from a fixed intelligence feed, useful exactly as long as adversary tradecraft resembles the tradecraft that produced the feed. A model built like a Large World Model is the incident responder brought in after an alert fires: forensically excellent about the compromised scene in front of them, blind to the drift that happened in the six months before they arrived and will happen in the six months after they leave. Neither escapes the Lucas problem. Both are estimating a regime and calling it the world.
The position that actually escapes it is the one where identity events, EDR telemetry, threat intelligence and configuration state are held as continuously running streams rather than snapshots, each belief about "what normal looks like for this identity" or "what this alert pattern usually means" carrying a provenance stamp — when it was learned, under what conditions — and a decay function, so that a relationship formed under an old regime is marked stale rather than trusted by default. This is the Large Universe Model in this domain: not a better detector, but a different intake structure, in which the shift from one regime to the next is itself an observable event in the stream, not a silent failure discovered at the next hunt.
The defence that has no further version
There is a reading of this that says: fine, watch continuously, but continuous watching does not identify which relationships are load-bearing. That objection has real weight in security operations, where analysts already distrust models that flag everything as anomalous.
The remedy Lucas himself proposed was deep, policy-invariant structure — not endless data, but better theory about what is actually stable. In security terms: identify the attacker's actual constraints, the exploit primitives, the protocol weaknesses that don't change with fashion, and build detection on those, not on streams of behavioural noise that will drift regardless of how continuously you watch them.
This is correct as far as it goes, and it describes real practice: detections built on protocol-level invariants, such as the structural properties of a Kerberoasting request or a pass-the-hash sequence, are far more durable than detections built on statistical baselines of "typical" login times. But identifying which primitive is actually invariant is itself an empirical claim, and the only way to test it is to watch it survive an adversary's attempt to route around it. A signature that looked structural — flagging a specific process-injection technique — can be defeated by a minor implementation change that leaves the exploited weakness untouched but the observable pattern gone. You only find out which was which by observing across the change. A frozen ruleset, however theoretically motivated, cannot do that; it has no view of its own boundary. Deep structure and continuous streaming intelligence are not competitors here. Theory proposes what should hold; the running streams are what adjudicate whether it did.
Real-time correlation across EDR, identity and config drift will misclassify transient noise as a regime shift constantly. A new laptop image rolling out to five thousand endpoints looks, for a few days, exactly like a coordinated compromise. A system watching everything continuously will be noisier, not calmer, than an analyst working a fixed hunting cadence.
This is the stronger objection, and it should not be minimised. Break detection has a latency floor set by signal-to-noise, not by how much is streamed; a genuinely gradual credential-harvesting campaign will still take time to distinguish from ordinary provisioning churn, no matter how many streams are joined. Continuous intake does not grant instant certainty. What it grants is that the uncertainty is dated and attributable rather than absent. A rule that has quietly stopped matching current adversary behaviour, under the old scheduled-hunt model, fails silently for the full interval until someone happens to look. A system holding provenance-tagged beliefs about "normal" can flag that a given baseline has not been reconfirmed against fresh telemetry in a defined window, and treat its own output with the appropriate discount, well before a human analyst would think to ask. Slower correct revision beats fast confident error. That is the whole of the gain, and it is bounded — dwell time shrinks, it does not vanish.
Beyond that bound there is no further category of evidence available. Longer retention, more sensors, finer telemetry sampling — these are more of the same kind of observation, not a new kind. Every stream still running, with provenance and decay attached to every belief formed from it, is the ceiling of what intake alone can do for the Lucas problem in this domain. What lies past that ceiling — better theory of adversary primitives, better organisational response — is a different axis entirely.