Definition
A detective control is a security measure designed to identify and alert on undesirable events or policy violations after they have occurred. It functions by continuously monitoring systems, logs, and network traffic for suspicious activity or deviations from normal operations. Implementing detective controls is crucial for understanding the scope of security incidents, enabling timely response, and preventing recurrence. For instance, intrusion detection systems (IDS) analyze network traffic for malicious patterns, flagging potential threats. Unlike preventive controls, which aim to stop incidents before they happen, detective controls focus on detection and response. This concept is a key topic in cybersecurity certifications like Security+, CySA+, and CISSP.