The loss happens upstream of where the model runs. Products filter and normalize before they forward, so the SIEM never holds the discarded fields and cannot be asked to hand them back. A detector reading that index is not working with a compressed copy of the environment. It is working with a curated one, and it has no record of what was curated out. Timing is the expensive part: a process-creation event that arrives without its timing relationship to adjacent events [2] cannot be sequenced against them, and sequence is most of the evidence in an intrusion.
Invert the column's ingest figure and the operative number is the complement. Between 80 and 90 percent of what the environment generated never reaches the analysis layer at all [10]. Now run the departing-employee case against that. The column describes four steps across four distinct systems [3]. Two of them raise anything a SIEM sees, the DLP alert on the download and the CASB flag on the upload [4], so half the chain is visible [11], and neither visible half carries the document's lineage or the user's six-month baseline [4]. Adding a model to that index buys faster inference over the same two fragments.
The premise underneath is that AI-assisted attacks now cross products, and stitching them requires multi-product data [14]. Same for the defensive baseline: one login at 1am is ambiguous, and it takes fifty logins over six months correlated with device telemetry to separate a travelling CFO from stolen credentials [5]. That is a retention requirement before it is a modelling requirement.
Two caveats, kept separate. First, this is a single opinion column at securityweek.com, and it states no methodology, sample or dataset behind the 10 to 20 percent [12]. Read it as a practitioner's estimate, not a measurement. Second, the remedy the column reaches is architectural: it argues that excluding source code, financial models and customer records from analysis is a choice rather than a technical limit, and that running AI inside the organisation's own environment lets that data in [8]. The compliance pressure it cites, GDPR, the US CLOUD Act, DORA and HIPAA [8], is real. The conclusion is also the shape of an on-premises product pitch. Both hold at once.
There is no CVE here and no deadline. What there is, is a ratio you can measure locally without asking a vendor: what a source generates against what your SIEM indexes and retains. The second figure is on your invoice. The distance between them is the ceiling on every detection model you buy, and nothing purchased at the analytics layer moves it.
