Detection got dramatically better over the last fifteen years. The decision that follows detection did not move at all. That gap is where the remaining value sits, and almost nobody is building into it.

There is a class of problem where the thing you are reacting to moves in seconds and the process that decides what to do about it takes minutes. Air defence is the obvious example. So is fraud, so is grid stability, so is any incident response function in a large organisation. In almost all of them, the same thing has happened.

I want to write about the shape of that gap rather than any particular instance of it, because the shape is the same everywhere and it explains why buying better sensors keeps failing to fix it.

Detection got solved and response did not

Sensing improved for reasons that are easy to identify. Sensor hardware followed semiconductor cost curves. Machine learning turned out to be very good at the specific problem of classifying a signal against a background. And the whole thing is measurable: you can score a detector against a labelled dataset, publish the number, and compete on it.

That last property matters more than the first two. Detection is benchmarkable, so it attracted effort, and effort against a clear metric produces progress.

Response has none of those properties. There is no dataset of correct decisions. The quality of a decision depends on context that is not in any log. It cannot be scored offline, and it involves people, authority and consequence, which are not things you can iterate on quickly.

So one half of the loop received two decades of compounding improvement and the other half received organisational reform, which moves at a different speed entirely.

Where the time actually goes

If you decompose the interval between a thing happening and something being done about it, the sensing portion is usually the smallest part.

Detection. Fast now. Often milliseconds.

Correlation. Multiple sensors produce multiple reports of possibly the same event. Deciding they are one event, or that they are three, takes time and is a genuinely hard inference problem. Getting it wrong in either direction is expensive.

Classification and confidence. Deciding what the thing is, and how sure you are. Confidence usually rises with observation time, which creates a direct tradeoff between certainty and remaining time to act.

Presentation. Getting the picture in front of whoever decides, in a form they can act on. This step is routinely underestimated. A great deal of latency lives in interfaces, formats and the fact that the decision-maker is looking at a different screen.

Authorisation. Somebody has to have the authority to act, be present, and be willing. In most institutions this is the largest single term, and it is not a technical quantity.

Execution. The action propagates to whatever performs it, which may involve systems that were not designed to be commanded quickly.

Detection is the first term and the smallest. Optimising it further is optimising the part that is already fast, which is why organisations that invest heavily in sensing often report that nothing improved.

Why authorisation is the hard term

The instinct is to say the answer is automation. Remove the human, remove the delay.

That instinct is right about the arithmetic and wrong about the problem. The human is in the loop for reasons, and most of them are good ones.

Accountability. Somebody has to be answerable, and accountability without authority is not a stable arrangement.

Context the system does not have. The operator knows there is an exercise today, or that this sensor has been misbehaving, or that the situation upstream changed an hour ago. Almost none of this is in the data.

Asymmetric consequences. In most of these domains, acting wrongly is much worse than acting late. That asymmetry is real and it correctly produces caution, and any automation proposal that ignores it is proposing to trade a visible failure mode for an invisible one.

So the useful framing is not automating the decision. It is reducing the time to a decision that a person still owns. Pre-authorisation for defined conditions agreed in advance. Better default options so the choice is between prepared alternatives rather than a blank page. Making the confidence and its basis legible, so the decision-maker is not also doing the analysis. Deciding in advance what happens if nobody responds in time, because a default exists whether or not you chose it.

The integration term nobody funds

The other large term is that the detecting system and the acting system are frequently different systems, procured separately, from different vendors, in different decades.

The path from one to the other often runs through a person retyping something, or a file transfer, or a phone call. This is the least glamorous latency in the whole chain and frequently the largest engineering component of it.

It persists because it is nobody’s programme. The sensor programme delivered sensors and met its requirements. The effector programme delivered effectors and met its. The path between them was in neither statement of work, and it is the part that determines whether the system works.

I have written about interoperability between systems that were never designed to talk and this is where it becomes a timing problem rather than an engineering inconvenience. A translation layer that adds two seconds is fine in most contexts and disqualifying in this one.

What this implies for measurement

If you work on something like this, the metric that matters is end to end and it is almost never the one being tracked.

Not detection accuracy. Not time to detect. Time from event to action, measured on real incidents, with the distribution rather than the mean, because the tail is the whole story.

Then decompose it and find the largest term. In every case I have looked at or read about, the largest term is not sensing. It is usually authorisation, or the handoff between two systems, and both of those are cheaper to fix than another sensor programme and much less interesting to announce, which is precisely why the money goes to the sensors.

The general statement: when one half of a loop improves by orders of magnitude and the other half does not, the loop does not get faster. It just becomes a system that sees things very well and watches them happen.

Related: