A response team wants to improve detection after finding that an attacker remained unnoticed for weeks. Which review is most useful?

1. Measure only how fast the final report was approved
2. Only count the final number of infected hosts
3. Map the attack sequence to telemetry, detection gaps, and actionable control changes
4. Replace every tool without analyzing the gap