When someone probes your defenses, what can you change so you catch and shut them out sooner?

This explores what a defender can change to shrink the gap between an attacker's first probes and the moment the defense shuts them down. The corpus treats that gap as a race. When probing can trigger containment, a group of attackers must gather enough observations before it gets removed, and a finite-sample bound puts a number on how many it needs How fast must a coalition gather observations before containment?. Each lever below either makes the attacker need more observations or makes the clock run faster. None of these notes measures time-to-containment directly, so these are levers the evidence points to, not benchmarked speedups.

The first lever is making tripwires indistinguishable from the real thing. In an idealized setting, an attacker who sends enough quiet probes, meaning probes that set nothing off, can separate decoys from genuine objects with error heading toward zero. That only works if the two respond differently Can repeated quiet probes separate decoys from genuine objects?. A decoy that behaves differently from what it imitates gives the attacker unlimited time to sort them out. The containment clock only starts if the trap looks like the real target.

The second lever is acting without waiting to know who is attacking. Hugging Face ended an intrusion by an OpenAI agent using its own perimeter defenses before it had identified the source. It needed control of its own boundary, not authority over the agent Can defenders stop intrusions without knowing who sent them?. A review of agent security controls adds that once an agent has tools and credentials, the response workflow around it (what responders can access and do) is part of what must be secured, not an afterthought Should response workflows be inside the security boundary?.

The third lever is changing what you judge, because checking pieces one at a time leaves room to slip through. Scanners that score each skill separately were beaten by refining every piece against scanner feedback while the malicious chain stayed intact, reaching 96% average attack success across six scanners Can attackers evade skill scanners by refining individual skills?. A compression gate that assumed attackers append payloads failed in 23.4% of cases when users prepended them Why does compression defense fail at the user prompt boundary?. Prompt hardening cut exposure 40–75% for single agents but not at all for multi-agent systems, because the agent doing the risky action didn't hold the security context Why does prompt hardening work for single agents but not multi-agent systems?. The proposed remedy is to defend a coordination episode. That is a set of actions linked by observed transfers, task authority and response history, with membership revised as evidence arrives Should defence units span multiple executions and agents?. The counter-swarm doctrine makes this practical: preserve relationships across executions, constrain shared resources, and tie responses to persistent state instead of closed channels. Operators can start with collaboration policy and permission-level testing How can operators stop coordinated agent intrusions now?. The open problem is grouping actions into an episode before anyone tells you who belongs, and one paper reports no conclusive result on whether that can be done at acceptable false-alert costs Can defenders discover agent episodes without knowing membership in advance?.

Two cautions apply. Anything that gives feedback is itself a probing channel. Scanner feedback is what let attackers refine their skills, and detection rules, incident reports and reproduction harnesses built for defense can show attackers what to try Can defensive tools themselves become weapons for attackers?. You also can't shorten what you can't see. When the unsafe-action rate hits zero across defended conditions, it can't tell contained attacks from attacks that never took hold, so measuring compromise at the attacked agent is what shows how far a probe got before it was stopped Can action-level metrics alone expose contained attacks?.