Did the new detection reduce dwell time, or did the attacks change?
Causal inferenceHardProblem. Your team shipped a set of new detections six months ago. Mean time to detect has fallen from 19 hours to 4.2 hours. Leadership wants to attribute that to the program and fund more. What do you tell them?
Before you reveal: say your answer out loud, as if you were in the real interview — get your reasoning across clearly first. There is no single correct answer: reading what the interviewer is really after and defending your own thinking is what makes an answer strong.