Dwell

fifty-four days blind, nine days slow — a story about where the time goes

1

The forensics report was eighty-one pages long, and Maya Reyes had read all of it twice, but the board only cared about one number, and it was on page four.

Sixty-three days.

That was how long the intruder had been inside Lakeshore Mutual's network before anyone noticed — from the first stolen credential in a regional claims office to the Tuesday morning her senior analyst, Priya, escalated a service account authenticating from a country where Lakeshore did not do business.

"Walk me through it," said Hendricks, the audit committee chair, in a tone suggesting he had already walked through it himself and hadn't liked the scenery. "We spend eleven million dollars a year on security. We have a wall of monitors downstairs that looks like NASA. And a man lived in our house for two months."

Maya had prepared for this. She had slides. Industry mean time to identify: months, per the published benchmarks — Lakeshore had beaten the average. She had the tooling roadmap and the request for four more analysts.

Hendricks let her get two slides in before he held up a hand.

"I'm not asking how he got in. Doors get opened; that's the world." He didn't raise his voice, which was worse. "I'm asking why nobody saw him for two months. Every year you come in here and ask me for more people and more software, and every year that number doesn't move. So I don't want to know what you need. I want to know what you know. Where did the sixty-three days go?"

And the honest answer — the one that followed her down the elevator, through the parking garage, and all the way home — was that she didn't know. Nobody knew. Her dashboards were green. Her team hit a fifteen-minute SLA on critical alerts. The days had gone wherever days go.

"I don't know yet," she said. "I know we didn't see him. I'll find out where they went and come back."

It was the least impressive sentence she had ever said to a board, and the only true one.

2

The first thing she did was the thing nobody had done: she asked when the alert had fired.

Not when Priya escalated. Not when the incident channel opened. When the platform first produced a signal that a human was asked to look at.

Priya found it in four minutes. The alert had fired on day fifty-four.

Maya sat with that for a long while. Fifty-four of the sixty-three days had passed before anything in an eleven-million-dollar security programme raised its hand. The remaining nine days were the part her team owned end to end — the part with tickets, timestamps, queues, and names attached.

She did not have one problem. She had two, and they had almost nothing to do with each other.

3

Saturday was her son Marco's ballgame, ten-and-under rec league, and Maya sat in the third row of aluminium bleachers not answering email, which was new.

The third-base coach, Walt Otani, had spent thirty-odd years running operations for an auto-parts manufacturer in Michigan before retiring into rec-league baseball and, according to his daughter, into other people's business. He came up the bleachers with two coffees.

"You look like a woman doing arithmetic."

"Sixty-three days. Fifty-four before our first alarm, nine after." She turned the cup around. "Everyone wants me to fix the nine, because the nine has tickets. I don't think the nine is where the time went."

Walt watched the pitcher fuss with his rosin bag. "The nine I can help with. How many things does your team have open right now — alerts, cases, whatever you call them?"

"About six hundred."

"How many finish in a week?"

"Hundred and fifty."

"Four weeks." He shrugged. "Six hundred over a hundred and fifty. Anything that comes in the door takes about a month to get out the other side, on average. Doesn't matter what your dashboards say, doesn't matter how hard anybody works. Same math as a parking lot."

"Our SLA on a critical alert is fifteen minutes."

"Sure. First touch is fast everywhere. It's everything after the first touch." He clapped twice for a kid who had swung at air. "Now the fifty-four. Say it back to me — what was happening in those fifty-four days?"

"Nothing. He was moving around and nobody was looking at him."

"So where did they go?"

"They didn't go anywhere." She heard it as she said it. "There was nothing to time."

"There it is." Walt looked the way he looked when a nine-year-old finally took a walk instead of swinging. "On my floor, when a bad part shipped, it was one of exactly two things. Either the inspection station was backed up — parts piled in front of a guy who existed, had a name, and had a queue I could measure with a stopwatch. Or there was no inspection station on that line at all, and the part sailed through clean because nobody was looking for that defect. Different problems. Different bosses. Different money."

"And you can't stopwatch the second one."

"You can't stopwatch what never started. You find it by subtraction: total time, minus the time you can account for. What's left is what you weren't watching." He drained the coffee. "Everybody in your building wants to argue about the pile, because a pile you can point at. Nobody wants to say out loud that on some lines there's no station."

The inning ended. He borrowed a pen from the scorekeeper and wrote six lines on his napkin, block capitals. The first one he underlined twice.

1. HOW DID YOU FIND OUT?
2. How many are open? How many finish in a week?
3. Add up the honest hands-on hours.
4. Split the number: blind vs slow.
5. Fix the biggest wait yourself. Ask separately for the missing station.
6. Count again.

"Step one first," Walt said, standing to go coach third. "Because if a customer told me my part was bad, then none of my stations were the problem, and I've got no business showing you my stopwatch."

4

Tuesday, a conference room, and the discipline of doing it in the order on the napkin.

Step one: how did you find out? An internal alert had fired. Late — but it fired, from their own platform, and a human triaged it. That mattered enormously, because if the FBI had called, or a partner, or a ransom note had arrived, then Lakeshore's detection pipeline would have contributed exactly zero of the sixty-three days, and every chart about triage queues would have been theatre. Maya wrote the discovery path at the top of the page and underlined it, because she could vividly imagine the version of the January meeting where she presented queue analytics for a breach a stranger had reported.

Steps two and three: the nine days. Priya pulled every status transition.

Six hours and forty minutes of human attention, floating in nine days of elapsed time. Priya ran the query twice, because the first reaction of every competent engineer to that ratio is that the query is wrong. It wasn't. Seven of the nine days — the largest single pile in the entire incident — were the alert sitting in a triage backlog that no individual owned, because the queue had always had a size limit and never an age limit.

Step four: split the number.

• Fifty-four days blind. No rule matched the technique he used to get in. Not a queue. Not slowness. An absence — visible only by subtraction, and only because somebody finally asked when the alert fired.
• Nine days slow. Entirely theirs, entirely measurable, and 0.3% of it actual work.

Two numbers, two owners, two completely different asks. The detection lead's first response to the fifty-four was the one she had expected and dreaded: "We have nine hundred rules."

"How many look for the technique he actually used to get in?"

He checked. None. Nine hundred rules, none covering that one, and nobody had ever computed that intersection because nobody had ever been asked to. Rule count had been the metric. Rule count is inventory, not coverage.

And it was not his fault, which Maya made a point of saying out loud in front of other people. He wrote detections between shifts, from whatever crossed his desk — a vendor blog, an incident, somebody's request. Nobody at Lakeshore had a job whose actual content was asking what the estate is not watching. Writing rules was a thing people did in the gaps. Coverage was a thing nobody did at all.

5

She called Walt on Sunday, mostly because she'd promised Marco good seats, partly because she wanted to say the numbers out loud to someone who wouldn't get defensive.

"Nine days is two," she said. "The triage backlog has an owner and an age limit now — nothing sits past twenty-four hours without a name on it — and Tier 2 escalation is pre-authorised for a defined class instead of waiting on a person. Zero dollars. Seven days out of the middle of it."

"There it is."

"And I want to be careful about the rest, so check me. I can't tell the board the fifty-four days are fixed."

"Course you can't. You can tell them there's a station going in on that line. You can't tell them what it'll catch until it catches something." A pause; aluminium-bat sounds behind him. "What you can do is tell them what the line looks like once the station's there. If a rule had fired on day one, how long from alarm to contained?"

"With the queue fixed? About two days."

"Then that's your number, and label it honestly — a projection, not a result. Fifty-four blind plus nine slow could have been about two days of process. That's the size of the prize. Don't promise it. Show them the arithmetic and tell them which half you've proved."

"And the coverage work is where my headcount ask finally makes sense," Maya said slowly. "Not 'we're overwhelmed.' 'We have nine hundred detections and nobody whose job is coverage — here is the specific list of techniques nothing is looking for.' A function with a mandate, not another pair of hands on the alert queue."

"Now you're asking for a station instead of asking for sympathy." Walt sounded like a man watching a runner take an extra base standing up. "One more thing and then I've got an umpire to annoy. The pile moves. You fixed triage; six months from now the biggest wait is somewhere else, and if you stopped counting it'll grow in the dark like the last one."

"Count again," Maya said. "Step six."

6

The next intrusion attempt came in November, and this time she watched her own machinery run — including the part that hadn't existed in August.

A rule fired on day one. Not because anyone was heroic: because the technique was on a list somebody had finally been paid to write, and the list had become a rule. The alert had an owner within the hour, because a twenty-four-hour age limit is a boring, unglamorous, load-bearing thing. Escalation didn't wait on a calendar. Containment took a day and a half.

At the January board meeting, Maya put up exactly one slide, and it was a photograph of a napkin.

"Last year you asked where sixty-three days went and I couldn't tell you. Here's the answer, in two parts, and they need two different decisions from you."

"Fifty-four days, we were not slow — we were blind. Nothing in our platform was looking for the way he came in. That number isn't a queue and I can't show you a stopwatch on it; I found it by subtraction, once we asked when the alert fired. We had nine hundred detection rules and no measure of what they covered. That's a capability gap, and it's the honest version of the staffing request I've made badly for three years."

"Nine days, we were slow, and I can show you exactly where — to the hour, from status-change timestamps any of you can audit. Seven of the nine were one alert in a queue with no owner. Six hours and forty minutes of that nine days was human work. We fixed it for nothing: an owner, an age limit, a pre-authorised escalation class. It runs at two days now, verified in November."

Hendricks studied the napkin on the screen — block capitals, coffee ring, first line underlined twice.

"And if you'd had both?" he said. "Both halves, working, last April?"

"About two days from entry to containment instead of sixty-three. I want to be precise: that's a projection built from measured flow, not a result. Nine days becoming two is verified. Fifty-four becoming one is a hypothesis with a rule behind it now, and the only way to test it is to be attacked again, which I don't recommend as a plan." She clicked the slide off. "So I've written down what I expect and dated it. Next quarter you'll see whether I was right, either way."

"Where's the next one?" he said. "The next pile."

"My guess is the log-access wait during investigation — we borrow IT's timestamps and pay a day for it. That's a guess. It's written down and dated, and I'll bring the timestamps."

Hendricks was quiet a moment. Then he said the only thing he ever said that Maya kept:

"First report in eleven years where I believed the numbers."

Outside, in the parking lot of a rec-league field across town, a third-base coach was explaining to a nine-year-old that the game is three hours long, the ball is in play for a few minutes of it, and the whole art is knowing what to do with the waiting — and, he added, knowing when nobody is watching the ball at all.

The napkin, for the record:

1. How did you find out? If a stranger told you, your detection queues explain none of it — say so.
2. How many are open right now? How many finish in a week? Divide: that's your real cycle time.
3. Add up the honest hands-on hours.
4. Split the number: blind vs slow. Blind is total time minus the time you can account for. It's an absence, not a queue.
5. Fix the biggest wait yourself. Ask separately — and specifically — for the missing station.
6. Count again.