The building was quieter than it had been the night before. The chaos had passed. The attackers were gone.
Inside the SOC, however, the work continued.
Logs were still being reviewed. Detection rules were being refined. Infrastructure diagrams were open across several screens as the team mapped the exact path the attackers had attempted to take.
The decoy environments were still running, but mostly idle now.
Empty.
Ari stood near the back of the room, watching the team work.
Keren noticed him.
“They're gone,” she said.
Ari nodded.
“They got nothing,” she added.
He paused for a moment before answering.
“They got something,” he said.
Keren raised an eyebrow.
“Education.”
The final report took several days to complete. Not because the attack had been complicated, but because Ari insisted it be clear. Precise. Unavoidable. Very Ari.
The document didn’t just describe what happened. It described why.
The first section detailed the intrusion attempts. The automated probing. The secondary manual access. The compression routines. The attempted command-and-control channels.
The second section showed how the SUW team had contained the attackers.
The decoy servers. The fabricated databases. And the fake command-and-control infrastructure.
Every step documented. Every decision explained.
But the most important section was near the end.
It wasn’t about the attackers. It was about the company.
The report described something Ari had been warning about for years. Security was not built on presentations. It was not built on compliance checklists. And it certainly was not built on expensive tools that looked impressive in meetings.
Security was built on foundational controls.
Strong authentication. Network segmentation. Monitoring that actually detected abnormal behavior. Systems configured to fail safely rather than conveniently.
The attack had not succeeded because those controls existed. It had almost succeeded because some of them had been weakened.
Budget adjustments.
Audit compromises.
Legal requirements that prioritized documentation over protection.
Individually, each decision had seemed reasonable. Together, they had created an opening.
The SUW team had closed that opening.
But the report made something clear.
They should never have had to.
When Ari walked into the boardroom a week later, the atmosphere was very different from the night of the incident.
The board members had read the report.
All of it.
The CEO nodded for him to begin.
Ari stood at the front of the room.
No slides.
No graphics.
Just the report.
“The attack failed,” he said. A few people shifted in their chairs.
“That doesn’t mean we were secure.”
Silence.
He explained the decoy environments, the data traps, the fake command channels. The targeted behavior of the attackers. All in a tone and language the board could understand: money.
However, most of his talk was about something else.
Foundations.
The invisible parts of security. The controls that never made headlines but prevented them. The controls that required investment, maintenance, and sometimes inconvenient decisions.
Ari spoke the way he always did: Direct. Unfiltered. Occasionally irritated.
But clear.
By the time he finished, the room was quiet.
One board member leaned forward.
“So the problem,” he said carefully, “wasn't that security cost money.”
Ari shook his head.
“The problem,” he said, “is when money gets spent on the wrong things.”
In the weeks that followed, several things changed.
Budgets were adjusted. Not dramatically, but deliberately.
Security investments moved toward the fundamentals.
And the SUW team.
The SOC expanded its capabilities as well. New detection models were built using the indicators the attackers had revealed.
The infrastructure grew stronger. Harder to enter. Even harder to stay inside.
Ari didn't celebrate any of it. He never did.
One evening, long after most of the building had emptied, he walked past the SOC.
The lights inside were still on. Analysts worked quietly at their stations.
The SUW team had one corner of the room now, their screens filled with new scripts and monitoring dashboards.
Keren noticed him passing by.
“You coming in?” she asked.
Ari glanced at the screens.
“Everything quiet?”
“For now.”
He nodded.
“Good.”
She smiled slightly.
“You know,” she said, “the board actually understood the report.”
Ari paused.
“That’s new.”
Keren laughed.
“They approved the budget changes too.”
Ari looked back at the SOC one more time. All the noise. All the systems. All the people quietly watching the network that connected everything.
Security, he thought, was rarely about heroics.
Most of the time it was about discipline.
Consistency.
And foundations strong enough that attackers simply moved on. Real security was never about the tools you bought. It was about the foundations you refused to weaken.
Ari turned toward the exit.
“Good work,” he said.
Then he went home.
← Back to all chapters