The side door never moved.

Monday's ninety day window has a much longer history behind it than the AI framing suggests. I've been doing this work for thirty years, and I've watched the same gap swallow five completely different technologies without changing shape once.

In the late nineties it had a modem attached to it. Somebody in a branch office wanted to reach a system from home, ran a phone line to a desktop, and left it answering. Security never knew. Nobody owned it. When it finally surfaced as a finding, the industry answered with war dialers and a policy that said don't do that.

Then wireless arrived. By 2003 you could buy an access point at an office supply store for under a hundred dollars, plug it into a live jack under a desk, and hand an entire floor of the building an unauthenticated path onto the corporate network. Identical problem, new radio. The industry answered with rogue AP detection, which became a scanning category, which became a budget line.

Then the cloud. A developer needed compute on a Thursday, opened an AWS account on a personal card, and by the time anyone thought to ask, a production workload was running inside it. CASB got invented. SaaS did the same trick a few years later through OAuth grants, so SSPM got invented for that. And now it's AI, where a team pays for an assistant, feeds it three years of internal documents to make it useful, and quietly builds a system holding more institutional context than half your sanctioned platforms.

Five waves. Every one of them produced a detection category and a budget line, and every one of them solved discovery reasonably well while skipping ownership entirely. We got very good at finding the thing. We never got good at putting a name beside it.

One thing did change across those five waves, and it isn't the part people expect. The gap stayed exactly the same width. The traffic moving through it got faster. A modem meant a phone install and a week of waiting. An access point meant a drive to a store. A cloud account meant a credit card and about ten minutes. An AI assistant means a work email address and roughly ninety seconds, and the person doing it has no sense of having crossed a line, because from where they sit they didn't.

The reason is procedural and boring, which is exactly why it has survived this long. Ownership in nearly every organization gets manufactured by procurement. The requisition carries an owner field. A signer goes on the contract. Somewhere in the vendor record sits a business contact, and that contact is who your access review emails eighteen months later. Every downstream control inherits its name from a purchase event. Skip the purchase event and the name never gets created.

Call it the arrival gap. It's the distance between the moment something starts running in your environment and the moment a specific human becomes accountable for it. Anything that moves through purchasing closes that distance in days. Everything else stays open until an incident forces the question, and an incident is a terrible way to learn who should have been watching.

Every ownership control we've built hangs off the purchase. Nothing hangs off the arrival. The side door keeps working because it sits in the space between two processes nobody ever bothered to join.

Watch what a program actually does when a new wave lands. It buys the discovery tool built for that wave, runs a scan, and produces a list of unsanctioned things. The list goes to the business as a compliance ask. The business reads it as an accusation, because that's what a list of your violations reads like no matter how the email is worded. Now the two groups who most need to talk to each other are further apart than they were in January, and the next wave is already coming through the same opening while everyone argues about the last one.

The teams who handle this well made one unglamorous change. They stopped waiting for a purchase order to tell them something new exists, and wired intake to signals that fire on arrival instead. A new application registered in SSO, an OAuth consent granted against the CRM, an unfamiliar software vendor landing on an expense report, a domain in the DNS logs that nobody recognizes. None of that is exotic, none of it needs a new platform, and all of it fires weeks before procurement would have said a word.

The difference on the ground is a change of tense. When marketing adopts a tool in June, the badly run version finds out in November through an audit and opens with why did you do this. The well run version finds out in June through an expense line and opens with who owns this. Same tool, same risk, same team. One conversation produces an owner and the other produces a grudge.

So when you finish Monday's list, resist the reflex to route it to procurement. Procurement is the process that already missed. Route each row to the person who benefits from the thing instead, and ask exactly one question: will you accept ownership of this? You get two possible answers and both of them are worth having. An acceptance gives you a name, a patching path, and someone to email at renewal. A refusal gives you written permission to turn it off, which is a decision most security programs cannot make on their own and spend years wishing they could.

Then watch what happens over the following quarter, because this is the part that pays. Once two or three business leads have been through the accept or decline conversation, the next tool starts arriving with a name already attached. Not because a policy changed. Because somebody remembers the question and would rather answer it in advance than get asked in front of their director. Ownership stops being an enforcement action and becomes a normal thing your organization does, and the ninety day list you build next quarter comes back shorter than this one.

Thirty years says the detection tooling will keep getting better and the gap will stay open, because there's no product to sell for the part that's actually broken. The arrival gap closes when somebody asks a person to put their name on something. That's a Tuesday afternoon and four emails, and it has outperformed every scanning category I've watched get invented.