---
title: 'ISR02: Insufficient Threat Detection'
description: OWASP Infrastructure Top 10 reference for insufficient threat detection vulnerabilities including missing monitoring and detection blind spots
---

# 02 Insufficient Threat Detection

Identifier: ISR02:2024
Category: Observability

## Description

Insufficient threat detection occurs when an organization lacks the processes and mechanisms
needed to identify threat actors and malicious activities before severe damage is caused.
In most cyberattacks, especially internal ones, the first detection of threat actors happens too
late, typically when ransomware encrypts data or an important server is disrupted.
Threat actors are normally present in an internal network for weeks or months before performing
conspicuous actions.
Qualitative threat detection is needed to identify threat actors in the initial access phase or,
at the latest, in the command and control phase.

## Risk

* If threat actors are not detected early, the target organization may be powerless to mount
  further defense actions.
* Insufficient threat detection is one of the primary reasons sophisticated cyberattacks succeed.
* Without proper detection and monitoring, organizations cannot observe attackers accessing the
  internal network or moving laterally through it.
* Late detection allows attackers to reach critical assets and cause maximum damage before any
  response occurs.

## Vulnerability checklist

* No Security Incident and Event Management (SIEM) system is deployed.
* Endpoint Detection and Response (EDR) is the only detection mechanism without network-level
  coverage.
* Detection sensors are not deployed across multiple infrastructure levels and ISO/OSI layers.
* No anomaly detection for unusual data transfers or access patterns.
* Monitoring coverage gaps exist for servers, network devices, or specific network segments.

## Prevention controls

1. Implement processes and mechanisms on different levels and points of the internal infrastructure
   to build a comprehensive threat detection system.
2. Deploy SIEM systems to aggregate and correlate security events.
3. Deploy Firewalls with inspection and logging capabilities.
4. Deploy EDR applications on endpoints.
5. Implement detection sensors on computers, servers, and the network across different ISO/OSI
   layers.
6. Implement anomaly detection for unusual data transfers and access patterns.

## Example attack scenarios

### Scenario A — Insufficient network detection

A company has an internal infrastructure with endpoint systems and servers for internal
applications holding mandatory business data.
EDR software is deployed on every employee's device.
An employee accidentally downloads and executes malware written by an Advanced Persistent Threat
group, and the EDR fails to detect it.
The malware compromises an internal server from the employee's computer and moves laterally,
compromising all internal servers.
These lateral movements are undetected because no network-level threat detection system exists.
The malware encrypts all server data, halting business operations.
A redundant and complete threat detection system beyond EDR would have detected this activity.

### Scenario B — Insufficient anomaly detection

A company hosts internal services for employees to share critical data and files, providing
laptops and VPN software for remote work.
An employee's laptop is stolen on a train; the cybercriminal gains access to the laptop and the
employee's account.
The criminal finds internal shares and downloads all files.
The company fails to detect this data exfiltration because it lacks anomaly detection that would
have noticed the large data transfer or access to shares the employee typically does not use.
The exfiltrated data and files are later sold to competitors.

## Detection guidance

* Monitor for gaps in logging coverage across the infrastructure.
* Validate that detection sensors cover endpoints, servers, and network segments.
* Test detection capabilities with simulated attack exercises and red team engagements.
* Review alert volumes and false positive rates to confirm detection fidelity.

## Remediation

* Deploy SIEM and centralized log aggregation across all infrastructure tiers.
* Add network-level detection sensors to complement endpoint-only solutions.
* Implement anomaly detection for data transfer volumes and access patterns.
* Conduct detection coverage gap analysis and address identified blind spots.
* Establish regular detection testing through adversary simulation exercises.
