The first is finding proof of an attack in progress which you are able to find and remediate thanks to threat intelligence and the EWS. This illustrates the fact that you will be compromised, so success is a matter of containing the damage and preventing data loss.