Over the holiday weekend I had some time to think (which can be a dangerous thing), and one of the things that has been on my mind is the need for real-time information to make quick, accurate, confident decisions. I put a short version of this up on LinkedIn, and the conversation it started was good enough that I wanted to expand it into a full post. When minutes matter, information wins. That lesson has been learned in every conflict this country has fought. It was true when riders carried word that the regulars were out. It was true when the Union cracked Confederate signals, when codebreakers shortened a world war, and when a forward air controller in Vietnam had seconds to sort friend from foe. The technology changes every generation. The requirement never has.
Col John Boyd distilled this into the OODA Loop (Observe, Orient, Decide, Act), and it is no accident that Observe comes first. Every decision inherits the quality of the observation that feeds it. If your observations are late, incomplete, or wrong, the loop doesn’t just slow down. It compounds the error. You orient on a false picture, decide with false confidence, and act on the wrong problem. Garbage in doesn’t just produce garbage out. It produces confident garbage, at speed, which is worse.
Most people who reference Boyd fixate on speed, on “getting inside the adversary’s loop.” But speed is a product, not an input. The input is observation. The fighter pilot who sees first, wins. The watch floor that spots the first sign of an intrusion has options that the one who finds it three weeks later does not. Decision dominance starts with observation dominance. There is no shortcut.
One of the replies to my LinkedIn post pushed on an important nuance, and it deserves space here. Observation is not a clean camera feed. Boyd himself put Orientation at the center of the loop, shaped by our genetics, our culture, and our previous experiences. Our default orientation, built from everything we have seen and done, affects how we observe the world and each engagement with an adversary. Our decisions and actions also impact our future observations, keeping the loop alive for the entire engagement.
This is where the idea of the Bayesian brain aligns nicely with Boyd. Each turn of the loop updates our orientation, and the more reps we have, the better our predictions and the faster our loops. This is why experienced analysts seem to “just know” where to look. They aren’t psychic. They have turned the loop thousands of times, and their orientation has been refined by every one of them. It is also why we need to be honest about the flip side. An orientation built on bad assumptions will filter out the very observations that would correct it. If you have ever watched an organization miss an intrusion because “that system isn’t internet facing” or “we don’t have anything anyone would want,” you have watched orientation defeat observation.
Here is the uncomfortable truth. Most organizations don’t deliberately consider how they observe. They don’t know what data and information is important to what they are trying to achieve. They don’t think about how they collect that information, or what it costs to collect it. And they don’t think about how to sort through the noise to get to the signal.
I have walked into plenty of environments that were collecting everything and observing nothing. Log sources feeding a SIEM that nobody tuned. Alerts covering every screen in the SOC while the analysts sat with their heads down, trained by years of false positives to ignore them all. Plenty of organizations pay to collect and store data they never actually use, which is noise with a bill attached. That is not observation. That is hoarding.
Fixing this doesn’t start with a tool. It starts with three questions, asked in order:
Why?
What is the mission of your organization? What are you actually here to do? This sounds basic, but I have sat in rooms where the security team could not articulate what the business does to make money or accomplish its mission. If you can’t state your why, everything downstream is guesswork.
What?
What do you need to protect to fulfill that why? These are your crown jewels, your critical systems, your data that actually matters. Not everything is critical, and pretending everything is critical is the same as protecting nothing.
How?
How are you going to protect your what? Now, and only now, do tools, telemetry, and collection strategy enter the conversation. Your how should be a direct answer to your what, which is a direct answer to your why.
When you work the ladder in this order, your observation strategy builds itself. You know what data matters, because it maps to what you protect. You know what to collect, because it gives you visibility into those things. You know what is noise, because it doesn’t. And you can finally have an honest conversation about the cost of collection, because every log source either serves the mission or it is a bill you are paying out of habit.
When you skip the ladder, you get what most organizations have. Shelfware, alert fatigue, and a very expensive pile of data that answers no questions.
As folks who have been through this process, it is our responsibility to help those who haven’t. Too many people in our industry try to sell the newest widget instead of working with clients to understand their pains and giving them guidance on how to solve them. Even if it isn’t buying your widget. The organizations that achieve decision dominance are not the ones with the most dashboards. They are the ones where accurate, contextualized information gets in front of the right people in time to matter. Whether it is a watch floor spotting the first sign of an intrusion, an analyst trying to remember where they saw that IP before, or a leader deciding whether to wake people up at 0200 for a perceived incident, the loop turns on observation.
Observe deliberately. Orient honestly. Decide with confidence. Act.
That is the work. Everything else is downstream.
