Incident responders have no shortage of products that help to identify threats. Time factors into each step of the incident response process, from time to detection through time to containment. Lets look at three major categories of threat detection to show how time effects each. An endpoint solution can only employ protection that can utilize rapidly enough to not impact endpoint performance noticeably. An IDS can only identify threats, whereas an IPS will also try and block threats that they can detect before the connection is complete. Some advanced persistent threats can take minutes (or longer) to identify.”]
Source: https://www.csoonline.com/article/3304252/threat-detection-it-s-about-time.html