Detection is not the constraint
Most organizations now collect more security telemetry than any analyst can read. Identity providers, endpoint agents, cloud control planes, network sensors, data platforms, and application layers all produce continuous evidence. The constraint is no longer visibility. The constraint is the determination made when that evidence disagrees with itself.
A detection tells you that something matched a rule or a model. It does not tell you whether the account is a service principal with a legitimate change window, whether the host is in a maintenance state, whether the same identity is implicated elsewhere, or whether isolating it takes a payment system offline.
Where decision quality erodes
Decision quality erodes in the seams between tools, in the difference between what an alert says and what the environment actually is, and in the compression that happens when several hours of investigation are reduced to a single sentence in a ticket.
- Context is reassembled manually and discarded after the incident closes
- Contradicting evidence is resolved informally rather than scored
- Confidence is expressed in prose instead of a calibrated value
- Blast radius is estimated from memory rather than from a system model
- The reasoning behind the action is not retained in reviewable form
What a decision layer changes
A decision layer does not add another detection source. It reconciles the sources already present, states what is known and what is contested, evaluates the proposed action against policy and authority, and produces a record that can be replayed months later by someone who was not in the room.