A detection gap is the time between a compromise and the moment defenders discover it. During this window, attackers can steal data, move laterally, create backdoors, or erase evidence while the organization still believes systems are normal. The longer the gap, the more time an intruder has to deepen access and increase the cost of response.
Detection gaps usually grow when alerts are missed, logs are incomplete, or patching is delayed on exposed systems. A unread antivirus alert may be an early warning that no one triaged, while an unpatched content management system can leave an internet-facing target open long after a fix exists. Defenses that reduce this gap include alert triage, centralized logging, asset monitoring, and fast patch management. In practice, shrinking the detection gap often matters as much as preventing the initial breach.