The defenders behind the headlines

At 02:14 on a Tuesday, an analyst on the night shift watches a single login flare on her screen. A service account, dormant for months, has just authenticated from a country the company does not operate in. She does not raise her voice. She isolates the host, kills the session, and starts pulling the logs that will tell her how far it went. By the time most of the building wakes up, the account is locked, the entry point is closed, and the incident that would have been a headline is a paragraph in a report nobody outside the team will read.

This is what stopping an attack usually looks like. Not a war room, not a dramatic countdown, just a tired person who recognised one wrong thing among ten thousand right ones and acted before it spread. The newspapers will run the story of the breach that succeeded somewhere else that week. They will name the group behind it. They will almost never name the analyst who made sure her company was not on the list.

We spend a great deal of attention on the attackers. We catalogue their tooling, profile their motives, and give them memorable names. The people who hold the line get far less, and the asymmetry shapes how the public thinks about the field. It is worth correcting, because the answer to who stops cyber attacks is more interesting, and more human, than the headlines suggest.

The people the reports leave out

Read enough breach coverage and you start to believe defence is a product. Buy the platform, switch it on, sleep soundly. The annual reports that the field actually trusts tell a different story. The Verizon Data Breach Investigations Report has noted for years that human error and stolen credentials sit behind a large share of incidents, which means the response is human too. A tool flags an anomaly. A person decides whether it matters.

The defenders behind the headlines fall into a few recognisable shapes. There is the security operations analyst, the one watching the screens at 02:14, who sees the first sign and buys the rest of the team time. There is the incident responder who arrives once something has already gone wrong and works out how deep it goes, how to evict the intruder, and how to stop it returning. There is the threat intelligence researcher who studies the attacker so the defender knows what is coming. There is the engineer who hardens the systems quietly enough that most attacks fail before anyone notices them at all.

None of these roles produces a clean story. A prevented breach has no body count and no timeline to dramatise. ENISA, the European agency that tracks the threat landscape, publishes year after year on ransomware and supply-chain attacks, and the through-line is consistent: the organisations that come out intact tend to be the ones with people who had practised, who knew their own networks, and who could act fast under pressure. The capability lives in those people, and it walks out of the door when they leave.

Why their work is invisible by design

Success in defence is the absence of an event. That is the heart of the problem. When an attacker fails, nothing happens, and nothing is exactly what gets reported. A team can stop a serious intrusion on a Friday night and there is no artefact to show for it on Monday, no story to tell a board that thinks in incidents and losses. The UK National Cyber Security Centre frames its mission around making the country a safer place to live and work online, and most of that work is the same: preventive, steady, and unseen by the people it protects.

The invisibility has a cost. Boards fund what they can measure, and a quiet year reads as a year where the security budget was perhaps too generous. Analysts burn out under alert fatigue and leave the field, taking their judgement with them. The skills shortage that every industry report describes is partly a recognition shortage. We have not made the work visible enough for the people doing it to feel seen, or for the next generation to picture themselves doing it.

Naming defenders is not vanity. It is how a field keeps the people it needs. When a responder's actual decision under pressure is described and credited, two things follow. The person stays, because the work meant something beyond a line in an internal ticket. And someone younger reads the account and understands, for the first time, what the job really is and why it is worth doing.

How you actually recognise the right people

If the work is invisible, the obvious risk is that recognition rewards the loudest rather than the most effective. The defender who tweets through an incident gets remembered. The one who stayed off the wire and simply fixed it does not. Any honest attempt to name the people who stop attacks has to be built to resist that pull.

The method is older than the marketing that surrounds most awards. You ask for evidence, not assertions. What was the situation, what did the person decide, and what changed because of it. You score that evidence against criteria that are published before anyone enters, so the basis is the same for the analyst at a global bank and the lone defender holding together a charity's network on a fraction of the budget. You keep the basis the same for everyone, so the people who would never expense an awards fee can still be put forward by a colleague who saw what they did. And you read every nomination, because the responder who shortened dwell time on a live intrusion will never present as well on paper as a team with a communications department.

Done this way, recognition becomes a record rather than a transaction. It can be cited by a board deciding who to trust or by a hiring manager weighing a candidate, which means a name earned on merit travels further than one that was bought. The point is not the trophy. The point is that the analyst at 02:14 finally exists somewhere outside her own logs.

The analyst at 02:14 will never make the news for the breach she stopped, and that is precisely why a programme judged on merit and never bought exists to put her name on the record, so if you know a defender whose quiet work held the line, put them forward.