Colonel John Boyd built the OODA loop to explain why some fighter pilots win dogfights: not because they are stronger, but because they cycle through Observe → Orient → Decide → Act faster than their opponent, forcing the other side to react to a situation that has already changed. Security operations is the same contest. An intrusion is a race between the attacker’s loop and yours.
Mapping the loop onto the SOC
Observe: telemetry. Logs, alerts, threat intelligence, user reports. The quality ceiling of the whole loop is set here: you cannot orient around events you never collected. This is why log source strategy and detection engineering are not plumbing, they are the front half of every future incident.
Orient: context. The same alert means different things on a developer workstation and a domain controller. Orientation is where analyst experience, asset context, baselines and threat intelligence combine into “what is actually happening?” It is the phase most SOCs under-invest in, and the phase attackers deliberately target with noise, decoys and living-off-the-land techniques that resemble admin work.
Decide: playbooks and judgment. Standardized decisions (isolate host, reset credentials, escalate to IR) shrink this phase from minutes of deliberation to seconds of selection. Playbooks aren’t bureaucracy; they are pre-made decisions cached for 3 a.m.
Act: containment, eradication, communication. Then the loop restarts: every action produces new observations.
Why tempo beats perfection
A perfect decision made after the attacker has exfiltrated data loses to a good-enough decision made while they are still staging it. In practice this means:
- Automate the observe→orient hop (enrichment on every alert, not on demand).
- Pre-authorize common containment actions so analysts don’t wait for approval chains during off-hours.
- Measure loop time end-to-end, not just mean-time-to-acknowledge.
Disrupting the attacker’s loop
Defense can also attack the opponent’s OODA cycle: deception canaries corrupt their observation, network segmentation invalidates their orientation, and fast credential rotation forces re-decision. Tempo is a two-way weapon.
This article was originally published on Medium.