Time As A First-Class Dimension In SG/Sentinel: Faster For The Good, Detected-Before-Damage For The Bad
Summary
Two inversions of conventional WAF thinking. First: because we know what good looks like, security can make good users faster — fingerprint and allowlist the known-good, skip the expensive checks, and security stops being a tax everyone pays. Second: detect before damage, not instantly — an attacker probing makes many requests, and we need to catch them before they do harm, not on request one; we want them to make one mistake, a call none of our code ever makes, and the allowlist makes that mistake visible. The success metric follows: not requests blocked, but damage prevented, with legitimate users unaffected.
Key concepts
- Detect before damage — the time budget for detection is the probing window — minutes, not milliseconds
- Make good users faster — the fast-track design — deferred, and rewritten by the tabletop as zero-trust acceleration
- The multiple timelines — immediate, real-time-plus, near-real-time, analytical, historical — each serving the others
Key ideas
- Most WAFs hold no state after the decision; Sentinel makes the state object as rich as possible and refines the decision over time.
- The fast layers enforce known decisions; the slow layers detect unknown attackers — the combination needs no instant malice-detection.
- Damage prevented beats requests blocked as a success metric.
On this site
The detect-before-damage story in the research page's tabletop section; the fingerprint sits at the top of the deferred list because this brief made it the spine.