There is a quiet crisis unfolding inside security operations centers around the world. Analysts have access to more threat intelligence than at any point in the history of the discipline — IP reputation scores, geolocation feeds, autonomous system data, behavioral telemetry, dark web monitoring, and enrichment platforms that aggregate it all into a single pane of glass. And yet, organizations continue to be blindsided by attackers who know exactly how to disappear into the noise.
A striking data point crystallizes the problem: an estimated 94% of security incidents involve infrastructure deliberately designed to obscure attribution. VPNs, residential proxies, Tor exit nodes, bulletproof hosting, and cloud-based relay chains are no longer the exclusive tools of sophisticated nation-state actors. They are commodity resources available to virtually any threat actor willing to pay a modest subscription fee. The anonymization of malicious infrastructure has gone industrial — and most defensive programs have not kept pace.
When Data Abundance Becomes a Liability
The instinct within the security industry has long been to solve the visibility problem by adding more data. New feed? Integrate it. New vendor? Evaluate it. The underlying assumption is that with enough signals, patterns will emerge and attribution will become tractable. In practice, the opposite dynamic often takes hold.
Every additional enrichment source introduces its own taxonomy, confidence scoring methodology, and update cadence. Analysts must reconcile conflicting verdicts across platforms — one tool flags an IP as malicious, another rates it clean, and a third has no record of it at all. The cognitive overhead of arbitrating these disagreements compounds daily. Meanwhile, the attacker has already rotated to a fresh IP.
The challenge is no longer acquiring intelligence. It is operationalizing it faster than adversaries can cycle through anonymizing infrastructure.
This is the intelligence paradox: organizations that invest heavily in data acquisition often find themselves more overwhelmed, not less. The problem is structural. Enrichment data, by its nature, describes infrastructure that has already been observed. Anonymization services exist specifically to defeat observation-based defenses. Feeding more historical verdicts into a system that cannot process them in time does not close the gap — it widens the analyst's cognitive burden while the attacker operates freely.
The Reactive Trap
Most security programs are structured around detection and response — identify a threat, investigate it, contain it. This model is rational when attackers are slow-moving and infrastructure is persistent. Neither condition holds in the modern threat environment. Attack campaigns now routinely use thousands of IP addresses across a single operation, rotating automatically on schedules measured in hours or even minutes. By the time an analyst has finished investigating an alert, the indicator at the center of that alert is already obsolete.
Reactive programs are not failing because of poor execution. They are failing because the underlying model assumes a static adversary. The 94% anonymization figure is not a coincidence — it reflects a deliberate and rational attacker adaptation to the known weaknesses of indicator-based defenses. Threat actors have studied how security tools work and optimized their infrastructure specifically to defeat them.
A Structural Shift Toward Behavioral and Contextual Analysis
Closing this gap requires rethinking what useful intelligence actually looks like. Rather than asking whether a specific IP has been seen before, analysts should be asking behavioral questions: Does the traffic pattern from this IP match known attack tooling? Is the timing consistent with automated scanning or human-operated intrusion? Does the hosting provider, ASN, or geographic routing path align with the claimed identity of the connecting party?
These questions are harder to answer than a simple reputation lookup, but they are also significantly harder for an attacker to defeat by rotating infrastructure. Behavior travels with the threat actor. IP addresses do not.
Organizations that are making progress against anonymized infrastructure share several characteristics. They invest in network traffic analysis that captures behavioral signals rather than relying solely on indicator matching. They build institutional knowledge about attacker TTPs — tactics, techniques, and procedures — that allows them to recognize campaigns even when the underlying infrastructure changes. And critically, they treat threat intelligence as an input to hypothesis generation rather than a definitive verdict system.
What You Should Do
The security industry has built remarkable infrastructure for collecting and sharing threat intelligence. The next frontier is not more data — it is the organizational and technical capacity to act on the right data, faster than adversaries can evade it. Until that shift takes hold, the 94% figure will remain a stubborn benchmark of how far the defensive posture still needs to evolve.
