Polling is the Vulnerability: A Case for Event-Driven Cloud Detection#

Santi Abastante (cloud incident responder / security engineer)

• Why: If your cloud security story is CloudTrail → SIEM → maybe alert, this is a pointed architectural critique: the detection delay window is itself the exploitable vulnerability.
• What: An argument (built on real IR experience and prior VB 2025 analysis) that polling-based, stateless-correlation SIEM pipelines are fundamentally incompatible with event-driven cloud control planes, plus OpenCDR — an open-source event-driven detection/response system testing whether deterministic, near-real-time response is achievable. Ends with a live attack scenario exploiting detection delay against a SIEM pipeline versus the event-driven architecture (minutes → seconds).
• How: Eliminate polling stages, maintain explicit detection state, enforce idempotency at the detection layer so retries/out-of-order delivery don't break correctness; discusses real failure modes (degrading one ingestion component silently opens a gap).
• Where applicable: AWS-centric framing (CloudTrail, GuardDuty) but the architectural argument generalizes to any cloud detection stack; most relevant to teams that can rebuild response logic rather than tune existing SIEM rules. (from abstract only)