01The NIST Cybersecurity Framework in a nutshell
The NIST Cybersecurity Framework divides information security into five core functions: Identify, Protect, Detect, Respond and Recover. Together they form a logical cycle: know what you have and where your risks are (Identify), protect your systems (Protect), spot deviations (Detect), react to incidents (Respond), and then restore normal operations (Recover). In theory, all five deserve equal attention. In practice, some functions get plenty of attention, and the budget to match, while others fade into the background. Why is that, and what does it mean?
02Why detection is so popular
In recent years, detection tools have become the darling of the security market. From advanced monitoring platforms to AI systems that flag intruders in real time, they promise insight, speed and control. And they look impressive: dashboards full of graphs, world maps with flashing attacks, visual spectacles that seem to come straight out of a movie.
For executives and customers, those images are reassuring. They show that something is happening, that someone is "watching the dials". Within the industry, such screens are sometimes called, with a wink, a "management pacification device": they calm management more than they contribute to actual security.
Detection tools sell well because they tell an attractive story: "The hacker is already inside; we will find him first." After years in which organizations thought a firewall was enough, it became clear that no defense is watertight. So-called assume breach thinking became the norm, and vendors cleverly played into it with products that promise to detect intruders at lightning speed.
There is psychology behind it too. A tool that reports "5,000 attacks blocked" delivers tangible results. Well-executed hardening, which results in no alerts at all, is harder to celebrate. The human brain likes action and feedback. Prevention is important, but not exciting.
And then there is the business model: detection and response are usually sold as a subscription or managed service, with recurring revenue and high margins for the vendor. Prevention, such as hardening, is often one-off, quieter work. In short: detection combines visibility, adrenaline and a business model. No wonder it is popular.
03Prevention and hardening: the forgotten foundation
Prevention, on the other hand, the disciplined avoidance of problems, gets less applause. Hardening in particular, configuring and maintaining systems properly, is rarely glamorous work. Patch management, disabling unused services, restricting permissions, enforcing passwords: these are exactly the measures that prevent disasters, but nobody notices when things go right.
Yet study after study shows that the majority of incidents could have been prevented with these simple measures. The Center for Internet Security's Community Defense Model calculates that fully implementing the CIS Controls defends against 91% of known attack techniques, and that the basic set (IG1) already covers 77% of them: proper configuration, timely updates and an up-to-date inventory of assets.
But that last part is precisely what is often missing. Many organizations would rather invest in new tools than get the basics in order. The result: attacks through known vulnerabilities or default settings, the digital equivalent of a door that simply is not locked.
Why does prevention get so little love? Because success looks boring. A well-configured system does its job, without alarms, without applause. And within organizations, "security hygiene" is still often seen as a nuisance: something that slows down processes or gets in the way of users.
On top of that, hardening is not a product but a shared responsibility. It requires cooperation between IT and security, discipline, maintenance and sometimes a planned outage. That is harder to sell than a box with blinking lights.
04Neglected functions: Identify and Recover
It is not just prevention; other functions of the NIST model remain neglected as well.
Identify, knowing what you own and where it is, is underdeveloped in many organizations. According to research, only a quarter of companies have a complete overview of their hardware and cloud systems. And what you do not know, you cannot secure. Forgotten servers, old accounts and shadow IT are low-hanging fruit for attackers.
Recover, too, often gets attention only when things go wrong. Backups usually exist, but during an attack the recovery procedures turn out to be untested, outdated or incomplete. The result: long downtime, data loss and stress, because the disaster plan is still sitting on the shelf.
05The cause: psychology and incentives
The imbalance in the NIST model is no accident. It stems from three factors: human nature, economic incentives and organizational culture.
People like action. Seeing a threat and responding to it feels decisive. Preventing an attack feels... invisible. The constant stream of news about data breaches does not help either: it feeds the need for visible protection.
Economically, it makes sense: it is easier to sell a detection or response service than a prevention method the customer has to carry out partly themselves. Subscriptions and monitoring generate recurring revenue; well-executed hardening does not always.
And culturally, habit plays a part. For years, security was seen as something "IT takes care of". Prevention projects were often the first to go when schedules got tight, because "operations must go on". That is how a culture grows in which detection gets priority and hardening remains an afterthought.
06Toward more balance
A healthy security strategy requires balance. Too much emphasis on one function leaves the rest vulnerable. An organization that logs everything but does not update its servers mainly ends up collecting a lot of alerts about itself.
Researchers therefore recommend dividing budget and attention roughly as follows:
- 35 to 40% for Protect (prevention, hardening, patch management)
- 25 to 30% for Detect
- 25 to 30% for Respond and Recover
That is not an exact science, but it prevents one domain from swallowing everything. The core remains: a strong foundation, complemented by smart monitoring.
So what can you do, concretely, as an organization?
- Map your assets. You cannot secure what you do not know.
- Run structured patch and configuration management. Hardening is never "done".
- Measure progress, for example the percentage of systems that are fully up to date within SLA.
- Test your recovery plan. A backup is only worth something if you can restore it.
- Change the conversation. Do not just ask "How many attacks did we see?", but also "How many vulnerabilities did we fix?"
That is how you shift attention from excitement to stability, and that is exactly what real security needs.
07In closing
Every function of the NIST framework matters. Detection and response get a lot of attention, often rightly so, but they are no substitute for solid Identify and Protect processes. The challenge is balance: technology and discipline, visibility and calm.
The most mature organizations combine modern detection with strong preventive hygiene. They invest just as readily in the invisible work, patching, hardening, training, as in the newest tool. And interestingly: the better they do that, the fewer beeps appear on their dashboards. And that may well be the best signal of all.