Talos on 'attackers only need to be right once'

Cisco Talos published a short essay Wednesday, credited to a writer it names only as Hazel, pushing back on one of the more durable clichés in defensive security: the idea that “attackers only need to be right once, but defenders need to be right 100% of the time.” The analogy the piece reaches for is Wimbledon — presumably a nod to the well-known stat that a professional tennis player wins something in the neighborhood of half the points across a career and still wins matches, tournaments, and eras.

Analysis, not incident reporting. The essay itself is short and belongs on the reader’s screen, not paraphrased into a summary here; the specifics of Hazel’s argument belong to the primary source. What earns coverage is the flag being planted. Talos, a group that spends its working days actually inside real intrusions, has decided to spend a public post arguing against a framing that a lot of security marketing still treats as a settled truth.

Where the cliché came from, and why it stuck

The “right once vs. right 100%” line traces at least to the mid-2000s vendor-conference circuit, where it did a specific job. It sold products. It framed defense as a hopeless, asymmetric grind that only the correct SKU could rescue. It has survived, mostly unquestioned, into a decade in which nearly everything about the framing is empirically dubious.

Attackers, in real intrusions, are wrong many times. They fumble reconnaissance. They trip EDR rules for reasons they don’t understand. Their C2 gets flagged before they establish lateral movement. Their initial-access broker sells them a foothold that a hunt team has been watching for a week. The kill chain is a chain because there are links in it, and each link is a chance for the attempt to end in a Slack alert rather than a ransom note.

Defenders, in real environments, are wrong constantly. They miss the odd anomaly. They age out an alert without acting on it. They take the weekend. They run a tabletop and forget the follow-through. The systems they defend, more often than not, still don’t get owned. The 100% framing has always been asking the wrong question — not because there is some floor at which defense is “good enough,” but because the question of whether defense worked was never binary. It is a running score.

The Wimbledon analogy Hazel reaches for is the same insight from the other side. Losing a lot of points is not the same as losing.

Why the maintenance work matters

None of this is new. Critics of this framing have been making versions of the same point for at least a decade, in hallway talks at the smaller cons and in the DFIR community’s occasional grumbling online. The reframing has never quite dislodged the cliché from the vocabulary, and specifically not from the sales deck of every vendor that would like a customer to feel a low-grade panic about their own defensive posture.

Reframings like Hazel’s are worth reading not because they are novel, but because they are the maintenance work that keeps the field from settling back into the framing that sells the most product. If the cliché goes unchallenged for another five years, it will still be quoted in another five years, and the strategic conversations shaped by it will keep misallocating defensive budgets against a fictional adversary.

That misallocation is the real cost of the cliché sitting unrebutted. A CISO who has internalized the “100% or nothing” frame will underweight detection, underweight response, and overweight the promise of a preventive control that claims to close the last gap. The tell of a defender working under that mental model is the annual budget conversation in which everything gets pitched as a way to raise the wall a little higher, and nothing gets pitched as a way to shorten the time between compromise and eviction.

The Talos post does not spell that out — it is short, and it is a Wimbledon riff, not a budget memo. But the argument underneath it points there. Read the post. Argue with it. Forward it to the people at the sales-deck end of the pipeline. When the cliché shows up in the next vendor pitch — as it will — have the counterargument to hand.

Sourcing

• Cisco Talos Blog: Winning 54% of the time — Hazel, 2026-07-09
• Related: Talos on Curiosity: A Skill That Doesn’t Scale — 2026-07-04