Account takeover doesn't follow the pace of the rest of your queue. Credential theft, a successful sign-in, and the first attempt at lateral movement can happen inside the same coffee break. A response process measured in hours isn't a response process for this.
The correlation problem
The signals are usually all present and all separate. Impossible travel is one alert. A run of MFA denials followed by an approval is another. A phishing click three days earlier is in a different tool entirely. Each on its own is ambiguous. Together they're unmistakable.
- Impossible travel alone has a high false-positive rate, because VPNs exist.
- MFA fatigue alone looks like a user with a flaky phone.
- A phishing click alone is common and often harmless.
- All three on one identity inside a week isn't ambiguous at all.
Containment has to be one decision
Once a takeover is established, containment is several actions: revoke refresh tokens, force a password reset, require MFA re-registration, and sometimes disable the account. Executed separately, through separate consoles, by whoever has the right role, this takes long enough for the attacker to finish.
Why we still gate it
Disabling an account is disruptive and occasionally wrong. It stays behind an analyst approval, but the approval covers the whole containment set as one decision rather than four separate ones. Speed comes from removing the coordination cost, not from removing the human.