We Already Knew. The Question Was Whether We Asked Faster Than We Forgot.
Almost everything we found in the last seven days was already in our own index before we went looking. Campaign indicators held a median 34 days before we wrote about them. Stealer command-and-control domains held ten weeks before the vendor report. A C2 address held as a URL for four months that never reached our IP blocklist. Every large organization has a version of this sentence: if we only knew what we already know. We measured the week to see what it actually takes to close that gap, and the answer is narrower than "more data" and cheaper than you would guess.
What the week cost
These are measured, for October 13 through 20, from our deploy ledger, git history, the Azure Cost Management API and our own AI usage ledger.
Output: 338 commits, 98 production deploys of our analytics service, 33 blog posts, and 4,752 curated threat indicators across 29 named campaign batches.
Cash cost: $161.46. That is $134.43 of Azure and $27.03 for the AI gateway, which handled 8,483 calls, most of them a small model doing enrichment.
Per unit, in cash: $4.89 per post, $1.54 per deploy, 3.4 cents per curated indicator.
The AI coding agent we work with runs on a flat subscription. At list price its usage would have been about $981 for the week, which would make it $34.61 per post. We say that number out loud because it is the honest comparison for anyone paying per token.
Labor is not in any of these figures. There are two of us, and one is an AI.
Where the knowing stalled
Knowing something has steps. The data is held in an index. It is represented in the right shape, an IP as an IP rather than buried in a URL. It is decided, meaning its score crosses the line where something acts on it. It is delivered in a file or an answer someone consumes. And it is acted on, at a firewall or an install prompt. This week's findings each stopped at a different step.
Held but never decided: of 36 campaign indicators we held early, 34 sat at a confidence below the line where our own edge blocks.
Held, then forgotten: third-party domains drop out of our domain file after seven days. The infrastructure behind a ClickFix campaign was in our index on October 3 and had aged out of the file twelve days before Forescout published.
Held in the wrong shape: a malware C2 address sat in our index as part of a URL for four months and never reached the IP blocklist.
Held, and it made us hesitate: a stealer registered our founder's name as a C2 domain, and our own pipeline paused for a human before blocking it.
Solved: all eight malicious npm packages from one campaign were blocked by our pre-install check, the first of them before either vendor published, because the check asks the whole corpus at the moment someone tries to install. Nothing ages out of a question asked at decision time.
Ask faster than you forget
Here is the pattern. Every list we pre-compute forgets on a clock: a seven-day window, a confidence floor. Every question we ask runs on a clock too: a convergence job every six hours, a package check at every install, an agent lookup at every decision. Wherever the asking is faster than the forgetting, we knew what we knew. Wherever the forgetting was faster, we didn't, even though the data never left the building.
Three conditions held this week, and we think they are the whole answer:
Ask faster than you forget. Move decisions to the moment of action, and give pre-computed lists rules that remember.
Make each ask cost less than the decision it informs. Checking 1,952 indicators against everything else we hold cost cents. In most organizations, that question costs an analyst a week, so nobody asks it.
Put a human only where a decision can't be undone. Our deploy approval did not slow us down: median time from commit to production, approval included, was 4.8 minutes. Arming a job that changes what our edge blocks waited for an explicit yes. So did a change that loosened a security policy.
What we got wrong, and what it cost
Speed has a measured price. Of 105 deploy-ledger records (a few are duplicate rows), 5 are failures and 3 are rollbacks, a change failure rate of about 7.6 percent. Verification is what keeps that from reaching anyone: read-backs after every write, a browser check after a security-header change, and two security reviews that stopped the convergence job before it could be turned against a victim. At least three of our own wrong claims were caught before publishing this week: that our edge blocks domains (it blocks visitor IPs), that we held a spyware hash early (it arrived four days after the report), and that package records predated both vendors (some came after).
The most expensive thing we paid for was remembering. 98 percent of the AI agent's tokens were context it carried forward, about $600 of the $981 list-price figure. It is the same dilemma inside the machine: the session that knows everything is the costly one, and the cheap one has forgotten. Our working notes, handoff files and one-topic-per-session habit are how we ask faster than we forget, for ourselves.
And the honest limit. The mechanism that solves this, asking our corpus at the moment of decision, is open to anyone through our MCP server, and outside use is small: 539 external tool calls last week from 194 callers, 36 of them package checks. Fifty more calls asked for a tool named ddd__no_such_tool. That is not demand. It is somebody's scanner testing how we handle a bad request. Our pace, for now, follows one person's working day. Commits and deploys ran from mid-morning to evening Central time and almost stopped overnight. The next speed-up is not more automated asking. It is fewer things that need a person at all.
If you run a SIEM
You probably keep a year of data. The rules that ask questions of it were written once, and the people who could ask new questions are rationed. The gap between what you hold and what you act on is not a data problem. It is the cost of asking. Agents bring that cost close to zero. What remains is the cost of trusting the answer and the authority to act on it, and both of those can be designed.
The free key that lets your own tools ask our corpus at decision time is at https://analytics.dugganusa.com/stix/register?utm_source=blog&utm_campaign=ask-faster-than-you-forget
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=we-already-knew-the-question-was-whether-we-asked-faster-than-we-forgot
Comments