The Idea(s)

I propose:

"Just" automated detection is not enough anymore (when even the notion of reliable automated detection is still considered by many difficult/impossible/futuristic etc.)--detected events need to be reduced to actionable events, and actionable events need to trigger immediate (automated) response whenever possible.

The co-stimulation metaphor from immunology can be applied to automated systems to improve confidence that detected anomalies truly indicate a real attack by correlating attributes of system state at the time the anomaly is detected.