How Security Is Evolving: From Prevention to Threat Response

The corporate security landscape is becoming increasingly sophisticated. Attacks can be automated and leverage AI-based techniques to identify vulnerabilities and make attack campaigns more effective. 

The threat level remains high in Switzerland as well. In its semi-annual report covering the second half of 2025, the Swiss National Cyber Security Centre (NCSC) recorded a 108% increase in identified phishing websites, highlighting a rapidly growing wave of threats, including AI-based ones. Moreover, SMEs have become preferred targets for cybercriminals, as they often have less visibility and fewer tools available for continuous infrastructure monitoring. 

In this scenario, companies must consider an increasingly broad attack surface. It is no longer just a matter of servers, firewalls and workstations: there are also email accounts, browsers, SaaS applications, collaboration tools, mobile devices and Cloud services. 

And there is another factor to consider: the human factor. 

Email remains one of the main channels used to deliver phishing, Business Email Compromise, malicious attachments and fraudulent links. An effective security strategy must therefore address user behaviour as well, without turning training into a generic, one-off activity. 

Cybersecurity must become a continuous process involving people, technologies and procedures at every level of the organization. 

The first phase of an end-to-end strategy is naturally prevention. The goal is not only to prevent an attack from succeeding, but also to reduce the likelihood of it occurring and ensure that the organization is prepared to recognize its warning signs. 

This means working on two fronts simultaneously: people and technology. 

As mentioned above, people often represent one of the main entry points for external threats into the corporate ecosystem. For this reason, security training cannot be limited to an initial course or occasional communication. 

A Security Awareness programme must be continuous, measurable and integrated into the organization’s everyday activities. SaaS solutions such as FortiSAT from Fortinet, for example, make it possible to combine different levels of training: basic modules lasting approximately 8–10 minutes with quizzes, micro-learning sessions and much more. 

Training can be complemented by simulated phishing campaigns, which allow organizations to assess users’ ability to recognize a threat in practice. The value of these activities lies not in blaming those who make mistakes, but in identifying areas of greater exposure and addressing them through targeted training. 

Security Awareness thus becomes an integral part of the security posture and can also help organizations meet the requirements of frameworks and regulations such as ISO/IEC 27001:2022, NIS2, GDPR, DORA, PCI DSS and NIST SP 800-50. 

User awareness must be supported by layered technical protection. Email security represents a first layer, but protecting only the email client is not always sufficient. Modern work environments include platforms and collaboration tools such as Microsoft 365, Google Workspace, Teams, SharePoint, OneDrive and Slack, which must be considered an integral part of the security perimeter. 

The same applies to networks and endpoints. Next-Generation Firewalls such as FortiGate can help segment traffic and apply IPS, Web Filtering and Antivirus functionalities, while endpoint protection can be managed through centralized agents such as Forticlient managed by an EMS Server (Endpoint Management Server). 

The goal is to build a multilayered defence in which breaching a single barrier does not automatically mean compromising the entire environment. 

Even the best prevention strategy cannot guarantee that an organization will never suffer an attack. This is where the second element of end-to-end security comes into play: the ability to detect what is happening in a timely manner. 

An undetected threat can continue operating undisturbed. Conversely, the ability to identify anomalous behaviour immediately reduces the time available to the attacker and makes it possible to intervene before the incident has more widespread consequences. 

To achieve this level of visibility, it is necessary to continuously collect and analyse the events generated by the infrastructure. 

• Log analysis. Logs from the network and endpoints must be centralized and analysed in real time. Dedicated repositories, such as FortiAnalyzer, make it possible to collect this information and make it available for subsequent analysis activities.
• Filtering relevant events. However, the amount of data generated by a modern infrastructure is enormous. Manually analysing every event is unrealistic and risks creating another very human problem: the so-called alert fatigue, a condition of psychological and cognitive desensitization that occurs when operators are bombarded with excessive notifications. This is where event correlation, signature-based rules and Machine Learning techniques come into play. The goal is to move from millions of events to a much smaller number of anomalies that genuinely require analysts’ attention.
• Threat Intelligence. This activity is complemented by Threat Intelligence, which enriches events with information from global sources, such as FortiGuard Labs feeds. Mapping events to the MITRE ATT&CK framework also makes it possible to contextualize the observed behaviour and understand which stage of the attack path the threat has reached.

The point, therefore, is not to assess one alert at a time, but to transform an enormous amount of data into useful information for making informed decisions. 

The Security Operations Center is the entity within which monitoring, analysis and response are integrated into a continuous process. 

Its task is to monitor the ecosystem 24/7, identify when something is wrong, understand the nature of the event, assess its severity and activate the necessary actions. 

The operational cycle can be broken down into seven phases: 

• Protect, which concerns the configuration and management of perimeter defences and endpoints.
• Logging, which involves the centralized collection and analysis of data generated by the infrastructure.
• Detect, namely the identification of anomalous activities through event correlation and the use of analysis and artificial intelligence techniques.
• Investigate, to examine the alert in greater depth, distinguish a genuinely dangerous event from a false positive and place the observed activity within the Cyber Kill Chain.
• Escalate, when the incident is classified according to severity, for example through P1–P4 levels, and managed according to defined procedures and SLAs.
• Remediate, the phase in which the Incident Response Team intervenes to contain the attack, isolating compromised hosts, blocking malicious indicators and working to restore operations.
• Improve, because once the incident has been handled, it is necessary to analyse what happened, understand which defences worked and which need to be improved, and update rules and procedures accordingly.

The value of this model lies precisely in the continuity and circular nature of the process: the incident does not mark the end of security activities, but becomes a source of information for strengthening the organization’s security posture in the future. 

The post-incident review makes it possible to turn experience into tangible improvement: the information gathered during the breach can be used to update detection rules, modify policies, strengthen user training and adjust infrastructure configurations. 

With Tinext Cloud, prevention, monitoring and response are therefore not three independent activities, but parts of a single process of continuous optimization and improvement. 

For many organizations, particularly when it is not possible to have an in-house team of specialists operating 24 hours a day, relying on a managed service such as SOC-as-a-Service can be a way to strengthen their defences in a “holistic” manner. 

The evolution of cybersecurity therefore requires a change in perspective: from reacting to an attack to adopting a continuous, circular end-to-end strategy.