Detection Has Infected Your Thinking.

Almost every time I explain Ridgeback, I hear:

“How does it know whether contact with a Phantom is malicious?”

It doesn’t need to establish intent to enforce a rule. But the persistence of that question reveals the infection. Detection has become a governing doctrine: observe, classify, investigate, deliberate…and then, perhaps, act.

We have trained ourselves to treat uncertainty about motive as a reason to tolerate a condition our policy prohibits.

We have made hesitation respectable. Then built a budget around it.

Unassigned addresses present Phantom resources when interrogated. No business service lives there. Authorized scanners and operational tools are written into policy. Contact outside that policy meets the consequence the operator chose in advance. Rcore denies, expels, or disrupts without first establishing intent.

The operator decides which contact is prohibited and what consequence is appropriate. That decision belongs in policy, before the event—not in an investigation into motive afterward.

And yet the room wants a motive. 

An attacker? A broken application? An intern experimenting?

Investigate afterward. An unacceptable condition does not become acceptable because its cause was innocent. A firewall does not subpoena the packet. A badge reader does not need a psychological profile. But introduce a Phantom, and suddenly the network needs a confession.

Meanwhile, consider the investigative burden we already accept.

Hunt & Hackett’s 2026 Trend Report (p. 9) classifies 95% of its 2025 SOC investigations as benign: 81% benign true positives, 14% benign false positives. In most cases detection worked exactly as designed, and the activity was legitimate. The defender still paid to find that out.

The report argues that tolerating noise preserves detection sensitivity. Fair enough, for detection. It’s no argument for imposing the same burden on enforcing a rule you’ve already agreed to.

The attacker generates activity. The defender pays to interpret it. An alert alone puts no obstacle in the attacker’s path.

Yet propose enforcing a defined boundary, and the objection is that the actor might have meant well. We tolerate uncertainty when it creates work. We demand certainty when it could eliminate work.

Whether activity is malicious and whether it is permitted are different questions. Define the boundary. Establish the exceptions. Choose the consequence in advance. Scrutinize all three. Demanding proof of malicious intent before enforcing an agreed rule is bureaucracy wearing a threat-hunting badge.

Why pay to investigate permission that policy has already denied?