21 seconds: the median time to click a phishing link after opening the email, in the simulation data behind Verizon's 2024 DBIR.
254 days: the average time to identify and contain a phishing-initiated breach. Average cost: $4.80 million. (IBM Cost of a Data Breach 2025)
The attacker needs under a minute. The defenders, on average, need most of a year.
That gap is the whole job.
Investigation is how you shrink it. Not with more alerts, but with faster, better answers to the same few questions: what happened, how far did it get, and is it still happening.
Every day you cut off that timeline is money that doesn't burn.