Free tools Windows power users keep installed
One-click scans. No signup required.
Security teams may recognize familiar attack patterns yet still struggle to contain an intrusion because they cannot see how applications, identities, devices, and workloads connect. That is the observability gap: a detection alert says something may be wrong, but without relationship and traffic-path context, it can be hard to tell what is exposed or where to isolate the threat.
Why observability is a security problem, not just an inventory problem
An asset list can tell a team that a server, account, or application exists. It does not necessarily show which identities can reach which workloads, what an application depends on, or how an attacker could move from one system to another. Those relationships are essential for judging the significance of an alert and choosing a containment action.
As an Amazon Associate I earn from qualifying purchases.
This is the central argument of Raghu Nandakumara, VP of Industry Strategy at Illumio, in a TechRadar Pro Perspectives article published August 19, 2026. He writes, “What remains unpredictable is not attacker behavior, but organizational defense.” That is an attributed opinion from a vendor executive, not a neutral finding that applies identically to every organization.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe article reports that its cited Containment Gap research found IT vulnerabilities involved in 66% of attacks, credential theft and privilege escalation in 45%, and zero-day vulnerabilities in 23%. The page does not identify the underlying report’s publisher or year, so these figures should be treated as the article’s reported statistics—not universal rates or independently assessable benchmarks.
#1 Best Overall
How detection can fail to become containment
Detection and containment are separate capabilities. A monitoring system may identify suspicious activity, but responders still need enough context to determine which connections matter, what is at risk, and how to stop movement without unnecessarily disrupting business services.
The TechRadar article reports that 95% of security professionals in its cited research were confident they could detect unauthorized lateral movement, while 17% said they could isolate a compromised workload near-real-time; 51% said containment took a few hours or longer. The underlying report’s publisher, year, sample, and geography are not identified on the page, limiting what can be concluded from the percentages. The article also attributes a 29-minute average time to achieve lateral movement to CrowdStrike but does not name the report, edition, or year.
These figures illustrate the distinction the article emphasizes: a signal can be visible while the route, affected systems, and appropriate response remain unclear. They do not establish how an individual organization will perform.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What useful security observability should show
For security decisions, observability means more than collecting logs or discovering assets. It should help defenders understand relationships and possible paths across the environment.
- System relationships: how applications, identities, devices, and workloads interact, rather than only a disconnected list of assets.
- Reachability: which systems can communicate and where unnecessary paths create opportunities for lateral movement.
- Incident context: how an alert relates to affected workloads and their dependencies, so responders can select a proportionate isolation action.
- Encrypted-traffic visibility: how to monitor communications without weakening the security properties of the protocol.
These capabilities support both prevention and response, but they are not interchangeable. Mapping dependencies and reducing unnecessary access can limit routes before an incident. Rapid isolation is a response measure for a workload believed to be compromised.
Why TLS 1.3 changes the visibility design
Encryption creates a specific observability challenge. NIST explains that TLS 1.3’s forward-secrecy approach helps protect prior communications even if a TLS-enabled server is later compromised, but it can interfere with passive decryption methods enterprises have used to inspect TLS 1.2 traffic.
NIST’s final Special Publication 1800-37, published September 17, 2025, states: “Adoption of the TLS 1.3 protocol can disrupt current approaches to observing and monitoring internal network communications within an enterprise.” This is a protocol-specific issue; it does not mean that all encrypted traffic is invisible or that passive inspection is the only way to monitor security.
NIST also documents standards-compliant monitoring options, including builds intended to support real-time and post-facto monitoring and analytics. The publication describes the project as demonstrating ways to maintain visibility within TLS 1.3. Security teams should therefore assess how their monitoring design preserves TLS 1.3’s security properties while meeting their operational visibility needs, rather than assume that weakening encryption is the only answer.
Use proactive and reactive containment together
Reduce unnecessary paths before an incident
Proactive segmentation limits which systems can communicate, reducing the routes an attacker could exploit after gaining access. Relationship mapping helps teams understand dependencies before changing access rules, lowering the risk of disrupting legitimate application traffic. Segmentation is most useful when policies reflect actual system needs rather than broad assumptions about what must be reachable.
Rank #4
Isolate compromised workloads during response
Reactive containment focuses on stopping a suspected compromise from spreading. A team needs to identify the affected workload and understand its connections well enough to isolate it promptly while accounting for business dependencies. If responders lack that map, they may hesitate, or choose a broad action that affects unrelated services.
The two approaches address different moments in an attack: segmentation narrows paths in advance; isolation responds to a specific compromise. Both depend on reliable knowledge of system connections.
Recommended Free Tools
A practical way to assess the gap
- Map relationships, not just assets. Check whether the team can see dependencies and communication paths among applications, identities, devices, and workloads.
- Identify unnecessary reachability. Determine which paths are not required for business operation and can be removed or restricted through segmentation.
- Test the alert-to-action chain. For a representative incident scenario, establish whether responders can identify the affected workload, understand its dependencies, and make a justified isolation decision.
- Review encrypted-traffic monitoring. Confirm that TLS 1.3 visibility methods meet monitoring needs while preserving standards-compliant security properties.
- Measure containment in your own environment. Record how long it takes to move from a relevant detection to an appropriate containment action; do not assume the article’s reported survey figures describe your organization.
The NSA’s May 2024 visibility and analytics information sheet also connects visibility with reconstructing attack patterns, including activity after an initial phishing event. That limited point reinforces why relationship and activity context matter beyond the first alert.
Best Value
- Used Book in Good Condition
What the argument does—and does not—establish
Nandakumara’s piece makes a useful operational case for treating system relationships as part of security visibility and pairing segmentation with rapid isolation. Its cited percentages are difficult to evaluate independently because the underlying survey metadata is not provided on the page. The TLS 1.3 discussion has a distinct technical grounding in NIST SP 1800-37, but it is an example of a visibility design challenge, not proof that every enterprise has the same monitoring limitation.
The article points toward enterprise segmentation and breach-containment software as one possible category of support. Since its author is an Illumio executive, any product framing associated with that company should be understood in that context rather than as an independent product recommendation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
