Post #4070487

@mttaggart@infosec.exchange Of course, because it takes a while to get the full picture. Once we have indicators that we're dealing with SS or similar active threat, then we responding accordingly (all hands on deck again). But most of the time its not, so we don't. The answer to original question, knowing the threat class of the threat actor helps us not have to pull the fire alarm every time.