At 9:12 a.m., a monitoring tool flags a login to a finance user’s account from an unfamiliar country. The alert sits in a shared queue until an analyst opens it at 9:40. She spends the next 35 minutes pulling sign-in logs, checking the user’s laptop, and finding out who owns the finance systems. At 10:20 she asks a manager for approval to suspend the account. The manager is in a meeting until 11:00.<\/p>\n
Very little of that two-hour delay was technical work. Most of it was waiting: for someone to notice the alert, for someone to own it, for enough context to judge it, and for someone with authority to approve action.<\/p>\n