The Only Acceptable Remainder

The Case for 100 Percent Security Coverage

David Billeter - November 2026

Introduction

On the evening of July 29, 2017, Equifax’s Countermeasures team uploaded 67 new SSL certificates to a traffic inspection appliance in its Alpharetta, Georgia data center. Almost immediately, the team flagged a suspicious request from an IP address in China. The appliance sat in front of the intrusion detection and prevention systems protecting the Automated Consumer Interview System, the internet-facing portal consumers used to dispute their credit reports. Its certificate had expired on January 31, 2016. The appliance’s default setting let traffic pass anyway, so for nineteen months the systems behind it received encrypted traffic they could not analyze.

The attackers had entered on May 13 through an unpatched Apache Struts vulnerability. Over 76 days they ran roughly 9,000 queries against 48 databases, and 265 of those queries returned personal information. The breach eventually affected 148 million people. Equifax had the tools in place to detect the intrusion. Renewing one certificate revealed what those tools had been unable to see for more than a year and a half.

Security programs rarely describe themselves in these terms. They report coverage as a percentage: multifactor authentication on 97 percent of accounts, endpoint detection on 95 percent of devices, logging from 90 percent of systems. The percentage measures the defender’s effort. The attacker experiences only the remainder, and needs exactly one item in it.

The remainder was never acceptable, but it was widely tolerated, because finding it was expensive. An attacker searching a large environment for the one unmonitored server or the one portal without multifactor authentication had to spend time and skill to find it, and many never did. Artificial intelligence has sharply reduced that cost. Reconnaissance that once required patient human effort can now be delegated to software operating at a pace no human team matches. A gap that was once a probability is now a destination.

The required standard is 100 percent: every asset known, every asset visible, every required control present, and every control operating, continuously. Where direct coverage is impossible, a defined compensating control closes the specific gap, so that effective coverage still reaches 100 percent. Most organizations are far from that standard. It is nonetheless achievable, through an architecture designed for the ways its own controls fail.

Why the Gaps Were Tolerated

Equifax did not ignore the Struts vulnerability. Its threat team circulated the government alert to roughly 430 people within a day and instructed them to patch within 48 hours. Its security team then scanned for the vulnerable software and found none. One scan ran against the root directory rather than the subdirectory where Struts was listed. A second scanner checked 958 external-facing IP addresses and also found nothing. The gap was invisible to the organization that owned it. It was not invisible to the attackers, who entered through it on May 13.

That asymmetry is old. The defender must account for everything, while the attacker needs one opening. What kept the asymmetry from being decisive was the cost of the search. Mapping an unfamiliar environment, testing systems one by one, and recognizing which forgotten server or unprotected portal offered a way in took skilled human time, and attackers had to spend that time selectively. Organizations relied, often without saying so, on the probability that their particular gap would not be the one found. That reliance was never sound, but the economics of the search made it common.

The economics have changed. In November 2025, Anthropic reported disrupting an espionage campaign, attributed with high confidence to a Chinese state-sponsored group it designated GTG-1002, in which the operators used Anthropic’s own AI model to carry out an estimated 80 to 90 percent of the tactical work. Reconnaissance and attack surface mapping proceeded without human guidance, at request rates Anthropic described as physically impossible. Anthropic also reported that the model overstated findings and occasionally fabricated data, which it described as an obstacle to fully autonomous attacks. That limitation offers little comfort to a defender whose gap is real. A tool that sometimes reports openings that do not exist still finds the ones that do.

The report is a developer’s account of the misuse of its own product, describing a single campaign, and some researchers have questioned its framing. It nonetheless shows what the search now costs. When enumeration is cheap, parallel, and continuous, a gap that went unfound because no one had time to look is no longer protected by anyone’s time constraints. The remainder organizations once tolerated is now within easy reach of an automated adversary.

What Coverage Means

Coverage is not one number. It has four dimensions, and each depends on the one before it. An organization must know an asset exists, see what the asset is doing, place the required controls on it, and keep those controls operating. Equifax failed on all four, and the same failures continue to appear in more recent incidents.

Inventory

Equifax did not know what software was running in its legacy environments. Its scans for the vulnerable Struts component came back clean because they looked in the wrong place, and the component sat on the internet-facing dispute portal anyway. No control can be applied to an asset the organization does not know it has. Inventory is also the denominator for every other coverage figure. A report of 95 percent endpoint coverage means 95 percent of known endpoints, and an incomplete inventory makes every downstream number look better than it is.

Incomplete inventory often arrives through acquisition. Equifax grew through a series of acquisitions, and the House Oversight Committee found that the growth brought increasing complexity to its IT systems. In February 2024, attackers used stolen credentials to log in to a remote access portal at Change Healthcare that did not require multifactor authentication, and deployed ransomware nine days later. UnitedHealth Group, which had acquired Change Healthcare in 2022, required multifactor authentication as a standard across its organization, and its chief executive testified that the company had been upgrading Change’s technology since the acquisition. The standard was sound. It did not reach a portal inherited from an acquired company, and UnitedHealth put its 2024 costs from the attack at approximately $3.1 billion. Two cases do not establish a rule, but the mechanism is plain: a security standard applies to the environment an organization has inventoried, and an acquisition adds an environment inventoried under someone else’s standard.

Visibility

Knowing an asset exists is not knowing what is happening on it. When Equifax renewed the expired certificate on July 29, 2017, its staff detected suspicious traffic almost at once. They could not reconstruct what the attackers had done in the preceding 76 days, because for that period the monitoring systems had been unable to read the traffic. The asset was inventoried and the tools were in place. What was missing was the ability to observe, and without it the organization could neither detect the intrusion nor fully account for it afterward.

Deployment

A known, visible asset is still uncovered if the control the security design requires is not on it. After the breach was discovered, Equifax found a second dispute-portal server running the same vulnerable version of Struts. No certificate had been loaded for it, so its traffic had never been inspected at all. File integrity monitoring, which Mandiant told the Committee could have detected the attackers’ web shells, was not enabled on the portal.

The same gap appeared in 2025 in a form that shows how attackers use it. S-RM reported an incident in which Akira ransomware operators tried to deploy ransomware on Windows systems and were stopped by the victim’s endpoint detection and response tool. They scanned the network, found an internet-connected webcam with known vulnerabilities, and used it to encrypt the organization’s file shares over the network. The webcam had no endpoint agent and, as S-RM noted, was likely incapable of hosting one. The control performed as designed everywhere it was installed. The attackers simply went where it was not. Some devices will never host an agent, and those devices need a different control rather than an exception.

Continuous Operation

A control that is installed but not functioning reports as covered and protects nothing. The Equifax inspection appliance was in place throughout the intrusion. Its certificate had expired on January 31, 2016, and because its default setting passed traffic through regardless, it failed silently and open for nineteen months. The appliance was not an isolated lapse: Equifax had allowed more than 300 security certificates to expire, 79 of them for monitoring business-critical domains. On an inventory or a deployment report, each of those devices would have looked identical to a working one.

Attackers now target this dimension deliberately. The FBI and CISA advisory on Akira reports that the group’s operators commonly disable security software before moving laterally, including by uninstalling endpoint detection and response tools. Sophos has documented a growing category of tools built specifically to disable endpoint protection, including one, EDRKillShifter, that loads a legitimately signed but vulnerable driver to undermine security software. In the incident where Sophos found it, the attempt failed. The existence of the category is the point: adversaries are building tools to turn covered assets into uncovered ones without changing what the coverage report shows. Coverage must therefore be measured as an operating state, verified continuously, rather than as an installation count taken at audit time.

The four dimensions compound. A deployment figure measured against an incomplete inventory, with no check that the deployed controls are running, measures one dimension out of four against a partial denominator. Any coverage report built that way describes the defender’s effort, not the attacker’s opportunity.

The Arithmetic of Percentages

A percentage converts a count into something that sounds small. An organization with 50,000 accounts that reports 97 percent multifactor coverage has 1,500 accounts without it. Each of those accounts is a complete entry point, not three percent of one. The figure that matters to an attacker is the count, and the count is rarely the figure reported.

The 50,000 figure itself understates the problem. Human user accounts are the accounts organizations count most carefully, and they are a small minority of the identities in a modern environment. Service accounts, API keys, certificates, workload identities, and now AI agents authenticate to systems too, and they rarely appear in figures reported for human users. The 2026 Identity Security Landscape report, commissioned by Palo Alto Networks, which sells identity security products, estimated 109 machine identities for every human identity, 79 of them AI agents, based on a survey of 2,930 security decision-makers. Estimates vary by source and method, and the figure reflects respondents’ estimates rather than direct measurement. Applied to an organization of 50,000 users, it implies roughly 5.45 million machine identities. A report of 97 percent multifactor coverage would then describe 48,500 identities out of about 5.5 million, less than one percent of the population. Multifactor authentication is not the right control for most machine identities, so the point is not that each one lacks it. The point is that they sit outside the denominator entirely. In CyberArk’s 2025 edition of the same research, 88 percent of organizations defined privileged users as human only, while 42 percent of machine identities had privileged or sensitive access.

Equifax’s expired certificates belong to that population. A certificate is a machine identity, and Equifax had let more than 300 of them lapse, including the one that left its intrusion detection blind for nineteen months. None of those certificates would have appeared in a count of human users, multifactor enrollment, or endpoint agents, yet one of them determined whether the organization could see an attack in progress. The condition persists. In the 2026 survey commissioned by Palo Alto Networks, 71 percent of organizations reported that they had not fully automated certificate renewal and monitoring across all environments. Meanwhile, maximum lifetimes for public TLS certificates are falling from 398 days to 200 in 2026 and eventually to 47. The shorter lifetimes apply to public certificates rather than every certificate an organization uses, but the direction is clear: renewals are becoming more frequent, and each one is an occasion for the failure Equifax experienced.

How far the denominator falls short is hard to measure, because the missing assets are by definition the ones no one counted, and most of the available measurements come from companies that sell asset discovery. Their findings are nonetheless consistent with government audits. Axonius, which sells asset management software, reported in 2026 that across its customers, 12.7 percent of devices in a median inventory of about 298,000 were missing an expected security agent: roughly 37,000 devices per organization that an agent’s own console cannot report, because an agent cannot report its own absence. In 2020, the Government Accountability Office found that none of three federal agencies it examined had fully implemented hardware asset management, and that their monitoring tools did not provide an accurate count of the hardware on their networks. The two shortfalls multiply. Consider an organization with 10,000 endpoints whose inventory has found 9,000 of them. An agent installed on 95 percent of the known endpoints runs on 8,550 machines, and the coverage report lists 450 without it. In fact, 1,450 endpoints lack the agent: the 450 the report shows and the 1,000 it cannot, because they were never counted. The report says 95 percent; the real figure is 85.5 percent, and the number of unprotected machines is more than three times what the report suggests.

Precision fails in the same way. A coverage claim of 99.9999 percent sounds rigorous, but it assumes the denominator is known to within one asset in a million. An inventory that has missed a single server, a single acquired portal, or a single webcam has already made the figure meaningless, because the asset that matters is the one outside the count.

The available data suggests organizations are nowhere near even the lower figures. Okta, which sells identity and authentication services, reported that multifactor authentication covered 70 percent of workforce users among its customers as of January 2025, leaving nearly a third without it. Okta also found that adoption fell as organization size rose, although its figures cover only sign-ins through its own platform, and it has noted that larger organizations are more likely to use other providers as well. Microsoft reported in its 2024 Digital Defense Report that, among the ransomware attacks it observed reaching the ransom stage, more than 90 percent involved unmanaged devices used for initial access or remote encryption.

Recent breaches show what the remainder costs. In 2024, a financially motivated group Mandiant tracks as UNC5537 used credentials stolen by infostealer malware to access the Snowflake customer instances of approximately 165 organizations, and the affected accounts lacked multifactor authentication. A decade earlier, attackers reached Target’s network using credentials stolen from Fazio Mechanical Services, a refrigeration and HVAC contractor. A Senate Commerce Committee staff report, drawing partly on press reports, found that Target did not require two-factor authentication for all vendors with access to its systems. In both cases the organizations had authentication controls. The attackers used the accounts those controls did not reach.

The percentage also misdescribes how attackers behave. A coverage rate reads like a probability, as though an attacker selects assets at random and has a three percent chance of landing on an uncovered one. Attackers do not sample at random. They search, and an attacker able to test every asset will find a gap if one is reachable. When the cost of that search falls, as it has, the percentage stops describing risk at all. The only figure that does is the number of assets outside the standard, and the only acceptable value for that figure is zero, met either directly or through a defined compensating control.

Compensating Controls

Some gaps cannot be closed directly. The webcam in the Akira incident could not host an endpoint agent, and no amount of deployment effort would have changed that. Legacy systems, operational technology, and devices with fixed firmware present the same problem. The standard therefore cannot be that every asset carries every control. It is that every gap is closed, either by the control the security design calls for or by a defined compensating control that addresses the same risk for the same asset.

The idea is not new. The Payment Card Industry Data Security Standard has long allowed compensating controls, and version 4.0.1 sets out what one must do. It must meet the intent and rigor of the original requirement and provide a similar level of defense. It must go “above and beyond” the other requirements, so that controls already required elsewhere cannot be relabeled as compensation. It must address the additional risk created by not meeting the requirement, and it must address the requirement currently and in the future. The standard also requires processes ensuring that compensating controls remain effective after the assessment is complete, and it permits them only where an organization has legitimate, documented technical or business constraints. Its worksheet requires each one to state the constraint, the objective of the original control, the added risk, how the compensating control was validated, and how it will be maintained.

Those criteria translate into four rules for coverage.

The control must close the specific gap. A compensating control answers a particular risk on a particular asset. For the webcam, that might be network segmentation preventing the device from reaching file shares, or monitoring of all traffic from devices that cannot host an agent. Either would cover what the agent could not. A general claim that other defenses exist somewhere in the environment does not. The PCI standard’s own example shows the right shape: where a vulnerability cannot yet be patched, it combines internal segmentation, filtering of access to the vulnerable interface, and intrusion monitoring of all traffic destined for it. Each of those controls applies to the whole of the exposed traffic. They overlap rather than divide the work between them, so no portion of the traffic depends on a handoff from one control to another.

The control must itself be complete and continuously operating. A compensating control is subject to the same four dimensions as any other. It must cover every asset it is meant to cover, and it must be running. The Equifax inspection appliance was, in effect, the control that made intrusion detection possible for encrypted traffic, and it failed silently for nineteen months. Its default setting also shaped the outcome. Because the appliance passed traffic when its certificate expired, the failure produced no symptom anyone would notice. A default that blocked traffic would have caused an outage instead, which is a real cost and the reason such devices often fail open. But an outage is visible and gets noticed at once. A blind spot is invisible and can persist for a year and a half. Where a control’s failure mode can be chosen, the choice determines whether a gap announces itself or hides.

The control must answer a real constraint. The PCI standard limits compensating controls to organizations with legitimate, documented constraints, and that limit belongs in any coverage program. A compensating control is a fallback for an asset that cannot carry the primary control, not an alternative design to be chosen for convenience. Each one adds a second mechanism alongside the first, with its own configuration, its own failure modes, and its own need for verification. Used where the primary control could have been deployed, it adds complexity without adding coverage.

The control must not depend on human behavior. A control that depends on people behaving correctly cannot reach 100 percent, however good the training behind it. A randomized controlled study published in 2025 followed more than 19,500 employees at UC San Diego Health through ten simulated phishing campaigns over eight months. It found no significant relationship between completing annual awareness training and the likelihood of falling for a phishing email, and most employees spent a minute or less on embedded training when it was shown to them. Susceptibility grew with exposure: in the first month about 10 percent of employees clicked a phishing link, and by the eighth month more than half had clicked at least one. The researchers recommended that organizations shift their emphasis to technical countermeasures. Training can reduce how often a gap opens, and that has value. It cannot close the gap, because a control requiring every person to decide correctly every time will eventually meet the person and the moment where that fails, and an attacker who can send messages cheaply and without limit needs only that one. Training therefore cannot count toward coverage. Where a risk depends on human judgment, coverage has to come from a technical control that applies to the whole population regardless of what any individual decides.

A gap closed under these four rules is closed. A gap covered by a control that fails any of them remains open, whatever the coverage report says. Effective coverage of 100 percent means the count of assets with neither a primary control nor a qualifying compensating control is zero.

Simplicity and Depth

Reaching 100 percent raises a second question: how many controls it takes to get there. Every control added to close a gap creates a place where two mechanisms meet, and those meeting points can fail even when each mechanism works exactly as designed. Wherever possible, a single control should cover a whole population.

Seams

Controls meet in two ways that create gaps. In the first, two controls each cover part of a population, and together they are meant to cover all of it. The boundary between them is a seam: an asset that fits neither definition, a handoff that does not happen, a window between one control releasing an asset and the next one taking it up. In the second, one control depends on another’s output. Equifax’s intrusion detection depended on the inspection appliance to decrypt traffic, so when the appliance failed, the detection systems behind it failed with it while appearing to run normally.

Microsoft has documented a seam of the first kind in its own mail service. By default, Exchange Online accepts all mail addressed to an organization’s mailboxes that is delivered directly to it. Many organizations point their mail records to a separate filtering service so that incoming mail is inspected first. A mail record tells legitimate senders where to deliver, but it does not prevent anyone from delivering straight to the tenant, so mail sent that way bypasses the filter entirely. In an August 2025 post, Microsoft’s Exchange team said that customers who choose this more complex routing need to change the default, and described the exposure as a situation created by a configuration decision that added complexity to mail routing. Microsoft sells its own mail filtering, and its framing places the responsibility on customers who add someone else’s. The mechanics hold regardless of who bears the blame. The filter worked. The mail service worked. The gap lay between them, and it was closed by a single control: rejecting mail that did not arrive through the filter.

Most organizations operate a great many such boundaries. A 2025 study by the IBM Institute for Business Value and Oxford Economics, published in partnership with Palo Alto Networks, surveyed 1,000 executives and found that organizations used an average of 83 security solutions from 29 vendors. Palo Alto Networks sells consolidated security platforms, which gives it an interest in the finding, and the figure measures the size of security stacks rather than any harm caused by them. But the arithmetic is plain. Eighty-three tools can form more than 3,400 distinct pairs. Not every pair interacts, yet each pair that does is a boundary someone must design, configure, and verify, and the number of boundaries grows much faster than the number of tools.

Simplicity is measured in seams, not vendors. Replacing several vendors with one reduces nothing if the same number of handoffs remains inside the platform. The goal is fewer places where coverage depends on two mechanisms agreeing.

Defense in Depth as Perspectives

Simplicity is not an argument for a single layer of defense. Depth remains necessary, but it comes from looking at an asset from different perspectives, not from stacking more tools that look at it the same way.

Three terms keep the distinction clear. A perspective is what is being watched. A vantage point is where or when it is watched from. A control is the mechanism at that vantage point. The Cybersecurity and Infrastructure Security Agency’s Zero Trust Maturity Model, published in April 2023, organizes security around five pillars that serve well as perspectives: identity, devices, networks, applications and workloads, and data. It treats visibility and analytics, automation and orchestration, and governance as capabilities cutting across all five. The Cyber Defense Matrix, developed by Sounil Yu, uses a nearly identical set of asset classes. Most assets can be observed from more than one of these perspectives.

Depth comes from adding perspectives, and each perspective has to be complete on its own terms. Equifax had controls on several perspectives at once: network inspection, application patching, and file integrity monitoring on the host. None was complete for the dispute portal, so the depth existed on paper only.

Within a single perspective, more than one vantage point can help, provided each covers the whole population. The PCI example of a compensating control does this: segmentation, access filtering, and intrusion monitoring all address the network perspective, and each applies to all traffic bound for the vulnerable interface. Because they overlap rather than divide the work, a weakness in one does not leave any portion of the traffic uncovered.

What adds little is a second tool at the same vantage point. Reliability engineers call the underlying problem common-mode failure: redundant components that share a design or a viewpoint tend to fail on the same inputs. In a 1986 experiment, John Knight and Nancy Leveson had 27 versions of the same program written independently from one specification and ran each against a million test cases. The versions failed together on the same inputs far more often than independence would predict. The result was disputed by Algirdas Avizienis and colleagues, who argued that the experiment did not follow rigorous multiversion development practices. Two tools watching from the same vantage point share much of the same blindness. The second adds some detection, less than its presence suggests, and it adds a full seam.

Cloud

Cloud computing is not a sixth perspective. It is an environment that contains all five, and it is where keeping each one complete is hardest.

Inventory moves faster than any periodic process can follow. Sysdig, which sells container security, reported in 2024 that 70 percent of containers lived for five minutes or less. An asset with that lifespan can be created, used, and destroyed between inventory scans, and no agent rollout can reach it in time. In environments like this, coverage has to be applied when the asset is created, or it is not applied at all.

Cloud also builds a seam into its foundation. Under Amazon Web Services’ shared responsibility model, the provider secures the infrastructure and the customer secures what runs on it, and the customer’s share depends on which services it selects. The boundary between provider and customer is a division of work between two parties, and it moves from one service to the next. Each party can perform its own share completely while an asset on the line between them is covered by neither.

Concentration Risk

Simplicity invites an obvious objection. If one control covers a whole population, its failure exposes the whole population. In July 2024, a faulty content update to CrowdStrike’s endpoint software crashed Windows systems around the world. Microsoft estimated that 8.5 million devices were affected, less than one percent of all Windows machines. The event was an outage rather than a breach, but it showed what a single widely deployed control can do when it fails everywhere at once.

The objection is real, and it has an answer, though not the obvious one. Concentration determines how much a failure affects. What determines how long it lasts is whether anyone notices. The CrowdStrike update crashed the machines it reached, so the failure was noticed at once. Equifax’s inspection appliance also failed for everything behind it, but it failed open, and the blind spot lasted nineteen months. The Direct Send gap stayed open wherever no one changed the default. An automated adversary does not need a global outage. It needs a silent gap, and the defense against silent gaps is to make every failure visible.

Perspectives answer the rest of the objection. Simplicity applies within a perspective, where one control should cover the population if it can. Depth applies across perspectives, where independent controls watch the same asset in different ways. If the control on one perspective fails, the others continue to work, because they do not share its design, its vantage point, or its failure mode. Simplicity within, diversity across: that combination reduces the number of seams without concentrating all of the risk in a single mechanism.

Designing for Failure

Every control fails eventually. Agents fail one asset at a time, often without saying so. Agentless controls fail differently: when they fail, they fail for everything behind them. Defense in depth has to be designed around both failure modes, and with that design, 100 percent is achievable. Without it, no architecture gets there, and an architecture built on agents alone rarely does.

How Agents Fail

Agents fail in three ways.

They cover only what has already been found. No one installs an agent on an asset they do not know exists, so agent coverage can never exceed the inventory behind it. Shadow IT, forgotten servers, and acquired environments are gaps in an inventory and total gaps for an agent. The shortfall is measurable even where inventory is good. Absolute Security, which sells software that monitors and repairs endpoint agents, reported in 2024 that of 3 million enterprise PCs meant to be protected by an endpoint protection platform, almost 14 percent did not have it installed.

They run only where someone has built one. An agent works only on operating systems its vendor supports. Legacy systems, embedded devices, and operational technology frequently fall outside that list, as the webcam in the Akira incident did. An organization running any such system cannot reach 100 percent with agents alone, which is why an agent-only architecture rarely gets there. Those systems need coverage from another perspective.

They stop working, often silently. Memory faults, failed updates, unsupported configurations, and deliberate tampering can each leave an agent installed but not protecting. Absolute’s 2025 telemetry from more than 15 million PCs found that leading endpoint protection, security service edge, and patch management tools fell out of compliance with their organizations’ own policies 22 percent of the time. The industry has long treated this as a reporting task rather than an emergency. Documentation for Trellix ePolicy Orchestrator, the management console formerly sold by McAfee, acknowledges that agents can become disabled and recommends searching for inactive agents weekly, with a default query reaching back 30 days. Microsoft Defender for Endpoint marks a device inactive after it has gone seven days without reporting.

Even well-designed agents can degrade without going silent. When CrowdStrike’s Falcon sensor meets an operating system kernel it does not support, it enters a reduced functionality mode in which, as Red Hat describes it, the sensor cannot detect or prevent malicious behavior. According to Prelude Security, which sells control-testing tools, the sensor continues to send a heartbeat in that mode. This is a deliberate safety design, not a defect, and that is the point: silent degradation is a property of the agent architecture, not only of poorly built agents. Attackers also produce the same condition on purpose, as the Akira operators’ practice of disabling and uninstalling security software shows.

How Agentless Controls Fail

Agentless controls avoid all three agent problems. They do not depend on finding each asset first, they do not care what operating system an asset runs, and there is no software on the asset to hang or remove. Their weakness is the opposite of an agent’s: when an agentless control fails, it fails for everything it watches. Equifax’s inspection appliance did not go blind on one server. It blinded the intrusion detection for the entire dispute portal. A routing decision that lets mail reach an Exchange Online tenant directly bypasses the mail filter for the whole organization. An architectural flaw can bypass or nullify an agentless control across an entire network, or a large section of one, and nothing about the control itself will show it.

Planning for Failure

Defense in depth answers these failure modes only if it is designed around them, and the starting point is to understand the specific ways each control can fail before relying on it. For an agent, that means knowing which operating systems and kernel versions it supports, what it does when it meets one it does not, how it behaves when an update fails or memory runs short, and whether it reports any of this. For an agentless control, it means knowing where traffic or requests can route around it, what dependencies such as certificates and connectors keep it working, and whether it fails open or closed. Those answers matter as much as what the control detects, because they decide whether it can be part of a design that reaches 100 percent.

Because perspectives are independent, a failure on one can be covered by another that does not share it. A host whose agent has hung is still visible to the network and identity perspectives. A segment whose network inspection has gone blind is still watched by the agents on its hosts. That cover holds only if each failure is noticed quickly, and two practices make that happen.

Every control should report its own health, and silence should raise an alarm. Network operations addressed this problem long ago. RFC 2863, the Internet Engineering Task Force standard for monitoring network interfaces, defines notifications that a device sends when a link goes down or comes back up, and it acknowledges that a device failing outright may not manage to send one. The lesson in that caveat is that a failure has to be detectable from outside the thing that failed. Security tooling has been slower to adopt that discipline. Agent health is commonly presented as a status to be reviewed, with thresholds measured in days, as the Trellix and Microsoft examples show. Attackers work faster: the Akira advisory reports that in some incidents the group exfiltrated data just over two hours after gaining access. For agents, an endpoint that stops sending data should trigger an alert within minutes, and the alert should key on the data the control is supposed to produce rather than on a heartbeat, since an agent in a degraded mode may keep checking in while detecting nothing. For agentless controls the signals differ: an inspection device passing traffic it cannot read, a filter whose volume suddenly drops, a certificate approaching expiry. Health alerting has one limit. An organization can notice silence only from a control or asset it expected to hear from, so it answers the third way agents fail, not the first two.

Every control should be tested continuously. Health reporting shows that a control is running. Only a test shows that it works, and the Equifax appliance was running throughout. The FBI and CISA advisory on Akira recommends testing existing security controls against the techniques the group uses, and continually testing the security program at scale in a production environment. Because an agentless control fails for an entire segment at once, a single test against that segment reveals the failure. A recurring automated test that sent attack-like traffic to Equifax’s dispute portal and checked for an intrusion alert would have come back empty the first time it ran after January 31, 2016, rather than nineteen months later. Agents benefit from the same testing, since a test that produces no detection reveals a degraded agent that a heartbeat would hide.

Neither practice makes any single control perfect. Together with independent perspectives, they make each failure visible quickly enough to be covered or fixed before an attacker can use it. That is what 100 percent requires: not controls that never fail, but an architecture in which no failure goes unnoticed and no asset is left without a perspective watching it.

Conclusion

Equifax did not lack security technology. It had intrusion detection and prevention, an inspection appliance to feed them, and vulnerability scanners. The gaps that let attackers stay for 76 days and reach the data of 148 million people were failures to apply or maintain controls rather than an absence of technology: a scan pointed at the wrong directory, a second server never brought under inspection, file integrity monitoring not enabled on the system that needed it, and a certificate allowed to expire on a device that failed silently and open for nineteen months. Every dimension of coverage failed at once, and a single unpatched component gave the attackers a way through all of them.

Those gaps were found by an attacker working at human speed, in 2017. The same kinds of gaps persist today: in portals inherited through acquisitions, in devices that cannot host an agent, in machine identities that outnumber people by a wide margin and rarely appear in any coverage report, in controls disabled by tools built for that purpose, and in the seams between products that each work as designed. What has changed is the cost of finding them. Reconnaissance that once required patient human effort can now be delegated to software, and a gap that was once a probability is now a destination.

The standard that follows from that change is 100 percent. Every asset known, every asset visible, every required control present, and every control operating, continuously. Where a control cannot be applied directly, a defined compensating control closes the specific gap, meets the same standard itself, and never depends on people deciding correctly every time. Within each perspective, one control should cover the population wherever possible, because every additional control adds a seam. Across perspectives, independent controls provide depth. That depth has to be designed around how each control fails, so that an agent that stops reporting raises an alarm and an agentless control is tested often enough that a blind segment is found by the defender first.

Coverage reported as a percentage describes the defender’s effort. The attacker experiences only the remainder. The only acceptable remainder is zero.

References

Absolute Security. (2024, April). Cyber resilience risk index 2024. https://www.absolute.com/media/mzihnsao/abt-resilience-index-report.pdf

Absolute Security. (2025, June 4). New Absolute Security research shows top endpoint security controls fail 22% of the time [Press release]. https://www.absolute.com/press-releases/new-absolute-security-research-shows-top-endpoint-security-controls-fail-22-percent-of-the-time

Amazon Web Services. (n.d.). Shared responsibility model. https://aws.amazon.com/compliance/shared-responsibility-model/

Anthropic. (2025, November). Disrupting the first reported AI-orchestrated cyber espionage campaign [Full report]. https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf

Avizienis, A., Lyu, M. R., & Schütz, W. (1988). In search of effective diversity: A six-language study of fault-tolerant flight control software. In Proceedings of the 18th International Symposium on Fault-Tolerant Computing (pp. 15–22). IEEE.

Bunciak, S., & Stoner, E. (2024, November 5). Red Hat Insights expands its detection capabilities with CrowdStrike integration. Red Hat Blog. https://www.redhat.com/en/blog/red-hat-insights-expands-its-detection-capabilities-crowdstrike-integration

CyberArk. (2025, April 23). Machine identities outnumber humans by more than 80 to 1: New report exposes the exponential threats of fragmented identity security [Press release on the 2025 Identity Security Landscape]. https://www.businesswire.com/news/home/20250423817886/en

Cybersecurity and Infrastructure Security Agency. (2023, April). Zero Trust Maturity Model (Version 2.0). https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf

Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, et al. (2024, April 18; updated 2025, November 13). #StopRansomware: Akira ransomware (Joint Cybersecurity Advisory AA24-109A). https://www.ic3.gov/CSA/2025/251113.pdf

Goodin, D. (2025, November 14). Researchers question Anthropic claim that AI-assisted attack was 90% autonomous. Ars Technica. https://arstechnica.com/security/2025/11/researchers-question-anthropic-claim-that-ai-assisted-attack-was-90-autonomous/

Ho, G., Mirian, A., Luo, E., Tong, K., Lee, E., Liu, L., Longhurst, C. A., Dameff, C., Savage, S., & Voelker, G. M. (2025). Understanding the efficacy of phishing training in practice. In Proceedings of the IEEE Symposium on Security and Privacy. https://sysnet.ucsd.edu/~voelker/pubs/phishtrain-oakland25.pdf

IBM Institute for Business Value. (2025, January). Capturing the cybersecurity dividend: How security platforms generate business value [Conducted with Oxford Economics; published in partnership with Palo Alto Networks]. https://www.paloaltonetworks.com/resources/research/ibm-study-platforms-deliver-value

Klopsch, A. (2024, August 14). Ransomware attackers introduce new EDR killer to their arsenal. Sophos. https://www.sophos.com/en-us/blog/edr-kill-shifter

Knight, J. C., & Leveson, N. G. (1986). An experimental evaluation of the assumption of independence in multiversion programming. IEEE Transactions on Software Engineering, SE-12(1), 96–109.

Knight, J. C., & Leveson, N. G. (1990). A reply to the criticisms of the Knight & Leveson experiment. ACM SIGSOFT Software Engineering Notes, 15(1), 24–35.

Mandiant. (2024, June 10). UNC5537 targets Snowflake customer instances for data theft and extortion. Google Cloud. https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion

McAfee. (n.d.). ePolicy Orchestrator 4.6.0 software product guide.

McCloghrie, K., & Kastenholz, F. (2000, June). The Interfaces Group MIB (RFC 2863). Internet Engineering Task Force.

Microsoft. (2024). 10 essential insights from the Microsoft Digital Defense Report 2024. https://www.microsoft.com/en-us/security/security-insider/threat-landscape/10-essential-insights-from-the-microsoft-digital-defense-report-2024

Microsoft. (2026, January 15). Check service health at Microsoft Defender for Endpoint. Microsoft Learn. https://learn.microsoft.com/en-us/defender-endpoint/check-sensor-status

Microsoft Exchange Team. (2025, August; updated 2025, November). Direct Send vs sending directly to an Exchange Online tenant. Microsoft Tech Community. https://techcommunity.microsoft.com/blog/exchange/direct-send-vs-sending-directly-to-an-exchange-online-tenant/4439865

Okta. (2023). New report reveals trends in secure sign-in. https://www.okta.com/newsroom/articles/secure-sign-in-trends-report/

Okta. (2025). The Secure Sign-in Trends Report 2025. https://www.okta.com/newsroom/articles/secure-sign-in-trends-report-2025

Palo Alto Networks. (2026, May). 2026 Identity Security Landscape. https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/identity-security-landscape-report.pdf

PCI Security Standards Council. (2024, June). Payment Card Industry Data Security Standard: Requirements and testing procedures (Version 4.0.1), Appendices B and C.

S-RM. (2025, March 5). Camera off: Akira deploys ransomware via webcam. https://www.s-rminform.com/latest-thinking/camera-off-akira-deploys-ransomware-via-webcam

Shyamsundar, T. (2026, March 27). RSAC 2026 recap: Taylor Swift has her eras. So does cybersecurity. Axonius. https://www.axonius.com/blog/rsac-2026-recap

Singlemann, C. (n.d.). How to address Reduced Functionality Mode (RFM) in CrowdStrike. Prelude Security. https://www.preludesecurity.com/blog/crowdstrike-reduced-functionality-mode-rfm

Sysdig. (2024). Sysdig 2024 Cloud-Native Security and Usage Report. https://sysdig.com/blog/ciso-takeaways-sysdig-2024-cloud-native-security-and-usage-report

Trellix. (n.d.). Locate inactive agents. Trellix ePO - On-prem documentation. https://docs-dr.trellix.com/docs/locate-inactive-agents

UC San Diego. (2025). Cybersecurity training programs don’t prevent employees from falling for phishing scams. UC San Diego Today. https://today.ucsd.edu/story/cybersecurity-training-programs-dont-prevent-employees-from-falling-for-phishing-scams

UnitedHealth Group. (2025, January 16). UnitedHealth Group reports 2024 results [Press release]. https://prd.unitedhealthgroup.com/content/dam/UHG/PDF/investors/2024/2025-16-01-uhg-reports-fourth-quarter-results.pdf

U.S. Government Accountability Office. (2020, August). Cybersecurity: DHS and selected agencies need to address shortcomings in implementation of network monitoring program (GAO-20-598). https://www.gao.gov/products/GAO-20-598

U.S. House of Representatives, Committee on Oversight and Government Reform, Majority Staff. (2018, December). The Equifax data breach. https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf

U.S. Senate, Committee on Commerce, Science, and Transportation, Majority Staff. (2014, March 26). A “kill chain” analysis of the 2013 Target data breach.

Weston, D. (2024, July 20). Helping our customers through the CrowdStrike outage. Official Microsoft Blog. https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/

Witty, A. (2024, May 1). Testimony before the U.S. Senate Committee on Finance on the Change Healthcare cyberattack.

Yu, S. (n.d.). Cyber Defense Matrix. https://cyberdefensematrix.com/