Reactive response increases blast radius
When detection happens late, response becomes disruptive. Sessions must be revoked, users locked out, and incidents escalated to customers. Early detection would have limited impact, but manual processes delay action.