Zero Latency Threat Detection: why speed is now the measure of defense

TL;DR#

• Attackers now work at machine speed, while most detection still takes minutes to weeks. The whitepaper calls this mismatch “the Latency Gap”.
• More data did not fix it. The paper argues this is a time problem, not a data problem.
• Its answer: AI agents as a first tier that casts a wide net (recall first), with data kept where it lives and the SIEM as the system of record.
• Zero Trust decides who gets in. Zero Latency decides how long a risk is allowed to live.

The Latency Gap#

The paper's starting point is that AI has collapsed the time it takes to attack. It points to ransomware timelines that fell from about nine days in 2021 to as little as 25 minutes, based on Palo Alto Networks research. It also shows zero-day CVE triage rising from about 45 a day in 2018 to about 140 a day by late 2025.

The raw volume is just as large. The paper cites Microsoft's 2025 figures of about 4.5 million new malware files and 38 million identity risk detections every day. No human-led process can keep up with that. An attacker's tools now run in milliseconds, while detection typically takes minutes, hours or even weeks. That distance is the Latency Gap.

A time problem, not a data problem#

For years the answer to more threats was more logs, more storage and a bigger central SIEM. The paper calls this an architectural mistake. Moving and storing all that data costs more than protecting it, a cost it calls data gravity. Shipping logs to one place also adds delay and can lose the identity controls that protected the data at its source.

The authors' point is that a detection that fires late is not a defense. It is a record of what already happened. Detection should be judged by when it fires, not only by how accurate it is.

Cast a wider net with AI agents#

Most detection today is tuned for precision, because analysts can only review so many alerts. The cost is that new variants slip through, since a rule needs to match something it has already seen.

The paper proposes flipping this to recall first. AI agents, which can check far more signals than any analyst team, act as a first tier. They test every signal and pass only confirmed threats to humans. People handle the judgment calls, and agents handle the scale.

The paper illustrates this with a phishing scenario. A user downloads a malicious zip file. A rule-based system misses the new file hash, and the attack stays hidden for weeks. In the recall-first model, the unusual download is flagged within minutes, an agent sandboxes the file and checks it against global threat data, and the attack is blocked in under 20 minutes, before it can move laterally. This is an illustrative scenario, not measured data.

Keep the data where it is#

To make this work, the paper builds on Gartner's Cybersecurity Mesh Architecture. Instead of copying everything into one lake, the data stays in its own silos, such as endpoint and cloud. AI agents act as the connection between them and correlate signals in place, in real time.

The SIEM's role changes with it. It stops being the brain that does the detecting and becomes the system of record that holds confirmed alerts and compliance logs. That makes it cheaper to run. The paper also points to real-time analytics engines and open table formats as the technical base, so detection can run as continuous queries rather than slow batches.

What this means for security leaders#

The authors estimate a 40 to 60 percent drop in SIEM costs, and a drop in dwell time from weeks to minutes. The paper also makes a compliance argument. Incident reporting clocks are now short, and batch detection that takes a day or more makes them hard to meet. As summarized in the paper:

The takeaway#

The paper compares its idea to Zero Trust. Zero Trust moved security from the perimeter to identity. Zero Latency moves it again, to time. Zero Trust decides who gets in. Zero Latency decides how long a risk lives. If your defenses can only tell you what happened yesterday, the Latency Gap is where attackers operate.

Read the full whitepaper, and see how the same idea shapes our Cyber Defense 2.0 series.

Sources#

• Raghunathan, G. and Rebello, M. W., "Zero Latency Threat Detection," Journal of Information Systems Engineering and Management, vol. 11, no. 2s, 2026
• Welcome to Cyber Defense 2.0, Part 1, Trench blog