Brute force on a production host. Sentinel phones the owner.

What actually happens

The security team and the service owner both have correct positions here, and the incident is decided by which of them is reachable first.

Repeated failed authentication attempts arrive against a production host over a sustained period. The pattern is unambiguous: it is a credential attack, not a misconfigured client.

The security response is to isolate the host, which is correct from a containment perspective and potentially catastrophic from a service perspective, because the host is serving live traffic and the security team does not know what depends on it.

The service owner response is to keep the host serving, which is correct from a continuity perspective and potentially catastrophic from a security perspective, because a successful authentication ends the debate on terms nobody chose.

What resolves it is a conversation, and conversations at two in the morning between a security analyst and a service owner they have never met are slow. The escalation path exists on paper and is measured in tens of minutes in practice.

The attacker does not wait for the escalation path. Published research consistently puts attacker breakout time well inside the window most organisations take to convene that conversation.

Isolate and you might cause the outage. Wait and you might get one anyway, on the attacker schedule rather than yours.

The same attack, two ways

Both columns detect the attack at the same moment. What differs is how long it takes to get a decision that both sides can live with.

The number to focus on is the uncontained window, because that is the window in which an attacker with valid credentials can move laterally, and published research on breakout time is the reason it matters.

The reason the first column takes fifty-five minutes is not analysis. The pattern was confirmed in sixteen. The remaining time is spent working out what the host does and then finding a human who can authorise a trade-off.

Presenting containment options with their service impact attached is the mechanism. The service owner is not asked "can I isolate your host", which invites a defensive answer, they are shown three options with what each one costs, which is a question they can answer in seconds.

The blast radius mapping has to happen before the call, not during it. A call that begins with "what does this host do" wastes the interruption; a call that begins with "here are your three options and what each costs" uses it.

Who decides to press go

Every containment option on this page carries service impact of some kind, so none of them execute without an approval.

Blast radius mapping, option generation, evidence collection and lateral movement monitoring all run under policy. None of them touch the host.

The Action Ticket carries the selected option, its measured service impact, the dependent service list and the rollback path. The service owner or security duty manager approves before it executes.

If nobody answers, the escalation continues up the chain rather than defaulting to action. An unanswered call is not an approval.

Sustained failed authentication against a production host serving live traffic. Pattern consistent with a credential attack rather than a misconfigured client.

Host role, live traffic, dependent services, recent successful authentications and lateral movement indicators correlated. Blast radius mapped before any option is proposed.

Containment options generated with service impact attached. Voice call placed to the service owner with the option list prepared. Selected option staged for approval.

Source addresses added to the edge policy. Host authentication exposure reviewed. Lateral movement watch retained for the following period.

This is a platform capability, not a published customer deployment. The mechanism, which is correlated investigation followed by out-of-band contact and governed action with approval gating, is running in production today; see governed day-2 operations across 2,000+ nodes and closed-loop network automation. The voice scenario above applies that same mechanism to an identity and access context. The timings shown are modelled, not measured.