Washington Moves Slower Than Hackers. So Does Your Stack.
Jeff Darrington, Technical Marketing Director, Graylog
Last month I wrote about the US ranking 31st on the 2026 National Cyber Security Index, behind Albania, Moldova, and Jordan. I framed that as a structure problem. The Economist published a piece this week that explains it better than I did: it’s not structure. It’s speed.
The world’s richest country can’t defend its own vital infrastructure. Not because it’s underfunded. The US spends more on cybersecurity in absolute terms than almost anywhere on earth. The actual finding is that Washington moves slower than hackers do, at every layer where that comparison matters.
Three layers of latency, stacked on top of each other
The mismatch isn’t one bottleneck. It’s three, compounding.
Regulatory latency comes first. Standards for protecting privately owned infrastructure, power, finance, water, telecom, go through rulemaking processes and public comment periods measured in years, because the process itself was built for an adversary that also moved slowly. Procurement latency stacks on top of that. Even once a standard exists, the utilities and carriers who own most of that infrastructure acquire and deploy compliant technology through capital planning cycles that routinely run a year or more from identified need to working deployment. Operational latency is the layer that decides outcomes during an actual incident: the time between an attack starting and a human team noticing, escalating, and acting on it.
Each layer alone might have been tolerable against a slower opponent. Stacked together against one whose tempo has compressed to hours, the cumulative delay is the actual vulnerability. Not a missing tool. Not a missing dollar. A missing ability to move at a comparable speed anywhere in that chain.
Albania didn’t wait for a rulemaking cycle
I wrote about Albania topping that same index last month because a 2022 crisis forced a full institutional rebuild under one consolidated authority. The US has had no equivalent single galvanizing event forcing that kind of reconstruction, and without one, incremental improvement inside a large, federated, well-resourced system moves slower than wholesale reinvention inside a smaller one. Money buys capability. It has historically been much worse at buying velocity, because velocity is a property of how decisions actually get made, not how much sits in the budget line.
Get Graylog’s stories in your inbox
Join Medium for free to get updates from this writer.
The irony is that Washington already tried to fix part of this. Earlier this year, OMB issued M-26–14, replacing a volume-based federal logging mandate with an outcome-based one built around continuous monitoring and faster investigation. Good policy, genuinely. But a smarter regulation is still a regulation, and a regulation still has to travel through the same three-layer chain before it changes anything on the ground. Meanwhile, research on enterprise SIEM deployments found coverage for barely a fifth of the adversary techniques those same organizations already had enough log data to detect. Better rules don’t help if the layer underneath them still moves at the old speed.
The layer that’s actually yours to fix
Here’s the part that matters if you don’t work in Washington. You can’t fix the regulatory layer, and you probably can’t meaningfully speed up the procurement cycle of the broader industry you sit inside. You can absolutely fix your own version of both.
The organizational equivalent of procurement latency is the runway between signing a contract and getting real detection value out of it, and that gap is entirely a platform design choice. A tool that needs months of professional-services work and custom parser development before it produces a first working detection recreates the exact mismatch the Economist is describing, just one level down, inside your own environment. A platform where raw log data loads and becomes searchable immediately, with no input to configure first, and where a new self-managed deployment gets guided from the web UI to its first working data source before a formal rollout review is even on the calendar, collapses that layer specifically.
The operational layer is just as fixable, and it’s the one lean teams usually assume requires headcount they don’t have. It doesn’t. Detection logic built around a standard entity model, so individually minor signals accumulate onto the account or asset they belong to instead of waiting for a human to notice the pattern, closes a real share of that latency by itself. Triage that connects directly to an already-assembled investigation, rather than an empty case an analyst has to build from scratch, closes more of it. Visibility into your own storage and data routing that doesn’t require a support ticket or a separate console removes the smallest, most frequently compounding source of delay in the whole chain.
None of that requires solving Washington’s problem. It requires recognizing you have the exact same three-layer problem at a scale you actually control.
The part that’s actually yours
Washington moving slower than hackers isn’t something any one reader fixes. But the same three layers, how slowly you decide, how long your tools take to produce value once you do, how fast your team acts on what those tools surface, live entirely inside your own walls. Albania didn’t wait for a global standard before it rebuilt. The organizations closing their own version of this gap aren’t waiting for Washington to solve it first either.
Graylog is built to collapse exactly that deployment layer: instant search on raw log data, guided onboarding to a first working dashboard, and entity-based detection that closes operational latency without adding headcount.
Follow Graylog on LinkedIn for practical guidance built for the teams running security operations themselves.
