Two ministry systems breached, SOC "blind": why modern monitoring matters

At Vietnam Security Summit in mid-2026, a national cyber agency representative disclosed two serious data breaches at ministry-level agencies — and the most worrying part: the on-site security monitoring (SOC) did not detect the attacks, while millions of records were compromised.

The lesson: having a SOC doesn't mean seeing

• Modern attacks are designed to evade traditional monitoring.
• "Blindness" is not from lacking tools, but from tools and processes not keeping up with new techniques.
• When undetected, attackers dwell longer — bigger damage.

What it takes not to be blind

• Monitor abnormal behavior, not only known signatures.
• Protect the app and API layer — a large attack surface (see cyber defense).
• Tight identity and device management; least privilege to limit damage.

Tetra

Orca WAAP protects web and APIs; Manta Security manages devices, permissions and access monitoring. To assess your current detection, book a consultation.