You have a firewall. You have antivirus, maybe EDR on every laptop. You’re paying for backup, VPN, and a pile of licences that show up on the invoice every month.
So here’s an uncomfortable question: if something happens at 2 a.m. on a Saturday, who actually sees it?
The paradox, put simply
Security tools don’t stop every attack. Some of them only raise alarms. A firewall logs suspicious connections, blocks some, lets others through. An EDR agent notices odd behaviour on an endpoint. A SIEM collects thousands of signals like these every single day.
None of it adds up to real protection unless someone is watching the dashboard and investigating the alerts.
That’s the paradox: companies invest serious money in prevention: tools, licences, ticks on a checklist, and assume that’s the same thing as being protected. It isn’t always.
What the numbers actually say
According to IBM’s 2025. report “Cost of a Data Breach” it takes companies an average of 181 days just to notice that a breach has happened, and another 60 days to contain it once they do. That’s roughly eight months in which an attacker sits quietly inside a network that was, on paper, “protected”.
The regional picture is no more comforting. The most recent annual reports from CERT Serbia show phishing incidents rising roughly 3.5 times year on year. Which means the entry points into your network are multiplying faster than most in-house teams can keep track of them.
Fast attackers, slow response. The damage happens in that gap.
Why the gap exists (it isn’t laziness)
This usually isn’t a question of competence. It’s a question of arithmetic. A typical in-house IT team is sized to keep the business running: tickets, updates, projects, deadlines. Monitoring security alerts 24/7, correlating them, and deciding which 3 of the day’s 300 notifications actually matter — that’s an entirely different job. It takes dedicated people, working in shifts, doing nothing else.
Most companies never budgeted for that job. They budgeted for tools.
What “actually protected” looks like
The answer isn’t more tools. The answer is a person, or a whole team, whose only function is to monitor, correlate and respond. In practice, that means:
Whether it’s an internal SOC or an external MDR service (Managed Detection and Response), the principle is the same: protection is a process, not a purchase.
The million-dollar questions. Or rather, questions worth the price of an average cyber attack €140,000?
If the answer to either one is “I don’t know”, it may be time to get in touch and run a security review of your environment.
The Point
Buying security tools proves you’re aware of the risk. Someone actually watching those tools proves you’re protected. Those are two different budget lines — and only one of them stops an attacker at 2 a.m.
Want a second opinion on whether your current setup is genuinely being monitored?
Saga’s cyber security team can walk through it with you.
