It is the most quoted line in cybersecurity: defenders have to be right every time; attackers only need to be right once. It captures something real about the anxiety of defense, and it is quietly wrong in a way that damages how teams think.
Where the cliché is right
At the perimeter, the asymmetry holds. One unpatched service, one phished credential, one exposed bucket, initial access does only need to succeed once. If your entire security model is “keep them out”, the quote describes your life accurately, and your life is bad.
Where it falls apart
An intrusion is not one event; it is a chain. After initial access, the attacker must execute code, persist, escalate privileges, discover the environment, move laterally, and act on objectives, each step generating telemetry, each step a fresh chance for the defender to be right once.
Flip the quote around and it is equally true: an attacker has to be invisible every time; the defender only needs to see them once. A single Sysmon event, one alert on an unusual Kerberos ticket, one canary credential being used, any of these can unravel a whole operation.
What this means in practice
- Stop optimizing only for prevention. The prevention layer is where the cliché is true. Detection and response layers are where it reverses.
- Instrument the middle of the kill chain. Lateral movement and privilege escalation are the noisiest, most constrained phases for an attacker, that is where defenders should be strongest, and where most environments are weakest.
- Make attackers spend their luck repeatedly. Segmentation, tiered admin, honeypots and canaries each force another dice roll.
The goal is not to be right every time. It is to build an environment where the attacker has to be.
This article was originally published on Medium.