What are detective controls designed to do?

Detective controls are designed to identify control problems and security incidents after they occur. These controls focus on monitoring and analyzing activities within a system to detect and respond to incidents that have already taken place. Examples include intrusion detection systems, log monitoring, and security audits, which help organizations recognize when a security breach or failure of control has happened, allowing for appropriate responses and remediation efforts.

While preventative measures attempt to stop security incidents from occurring and proactive enforcement of policies aims to mitigate risks before they lead to issues, detective controls specifically provide insight into the operational effectiveness of preventative measures and help businesses understand vulnerabilities in their security posture post-incident.