Relentless defence starts with knowing what changed

Research · 20 October 2026 · 5 min read · By the Tracknosis team

In April and May 2026, Cisco commissioned an independent, double-blind survey of 8,000 security professionals across 30 markets, more than a quarter of them CISOs. The result is the Relentless Defense report, and it is worth reading in full. Its central argument is a challenge to the industry: the biggest obstacle to good security today is not a lack of technology, but the friction that stops teams using it.

We read it with one question in mind: where does the evidence of an attack actually live, and can teams get to it?

The pressure is real, and it's rising

• 91% of security leaders had at least one material disruptive cyber incident in the past year.
• 35% of those incidents involved an AI-related attack.
• 80% believe agentic AI will let attackers run more persistent, adaptive campaigns with less effort.

The report also quotes Splunk's 2026 research: downtime now costs the Global 2000 around $600 billion a year, up 50% in two years, with nearly a third of it cyber-related. Incidents are no longer a question of if, and the attacks behind them are increasingly new, built quickly and designed to stay.

Teams are wrangling data instead of chasing threats

The most striking numbers in the report are about data, not attackers:

• 40% of security teams spend more time manually collecting and correlating data from different systems than dealing with the threat itself.
• 39% say critical insights are missed because the data lives somewhere they can't reach.
• Only 58% have a single, real-time view of their security data.

Cisco calls fragmented visibility the second-largest failure mode in incident response, nearly as common as not knowing who is in charge. Its recommendation is simple: build one picture, not multiple.

You can't defend what you can't see

Coverage is the other gap. Only 20% of organisations have active security protection on at least 95% of their endpoints. And while 98% are deploying or planning to deploy AI agents, only 41% apply consistent controls to AI agents, service accounts and other non-human identities. Just over half are very confident they could detect a compromised AI agent.

Put those together and the picture is clear: many teams are defending an estate they can only partly see, at a time when new kinds of software are arriving on their machines faster than ever.

Speed is limited by more than tools

Only 21% can fully stand up a new security control within six months, even after budget and approval have cleared. When a new threat appears, around 60% take more than a day to update their controls. And spending more doesn't automatically help: only 41% of organisations that increased their security budget saw fewer incidents.

That last point matters. If adding tools doesn't reliably reduce incidents, the question isn't "what else can we buy?" but "what are we still not seeing, and why does it take so long to find out?"

Hard to explain, hard to fund

43% of practitioners say what they track is too technical to influence executives, 36% struggle to turn it into business impact, and 27% have no consistent way to measure performance at all. Without evidence people outside security can understand, the case for investment stalls.

What this means for Windows visibility

The report is right that much of the friction is organisational: ownership, escalation paths and decision rights need fixing by people, not products. But several of its findings come down to one practical question that every incident eventually asks: what changed on this machine?

Answering it usually means pulling logs from several systems, if they were switched on, kept and not wiped. That is exactly the data-wrangling the 40% describe. And the newest attacks, including AI-built ones, don't match any known signature, so they only show up as change.

Where Tracknosis fits

Tracknosis is built around that question. It is a lightweight agent for Windows, with no kernel driver and no audit-policy changes, that reads every file and registry record directly from the disk and compares each scan with the last. In practice that addresses several of the gaps in the report:

• One picture of what changed. Every file and registry change on the machine, in one view, rated High, Medium or Low with a plain-language reason. No correlating data from several systems.
• Evidence you can reach. The record comes from the disk itself, so it doesn't depend on logs being enabled, kept or left intact. Cleared event logs and switched-off auditing are flagged too.
• No signatures needed. New and AI-built attacks show up as change, whether or not anyone has written a rule for them yet.
• Persistence, surfaced. New or modified autoruns, services, scheduled tasks and Run keys are flagged after each scan, the footholds that more persistent campaigns rely on.
• Easy to put everywhere. No driver and no new logging pipeline means fewer reasons for a machine to be left out, including legacy servers and Citrix or VDI.
• Evidence executives and regulators can read. Plain-language findings and report drafts for NIS2 (and coming CIRCIA rules), built from that evidence. Findings can also be sent to Splunk, adding to the view your team already uses.
• Nothing lost while nobody was watching. If monitoring is interrupted, the next scan still reads the changes straight from the disk, including tampering done in between.

None of this replaces clear ownership or a practised playbook; the report is right that those come first. But when the incident comes, the team should spend its time deciding, not digging.

The takeaway

Cisco's Relentless Defenders, the top 8%, aren't the biggest spenders. They work as one team, from one picture, and remove the friction that keeps their tools from doing their job. For Windows machines, part of that picture is simple and long overdue: a forensic record of what changed, that everyone can see and trust.

Source: Cisco, Relentless Defense: A global report about cybersecurity in the AI era (2026). Survey of 8,000 security professionals across 30 markets, conducted April–May 2026 by Satori Experience; analysis by Sandpiper. Downtime figures from Splunk, The Hidden Costs of Downtime (2026), as cited in the report. Tracknosis is not affiliated with or endorsed by Cisco.