Machine speed. Human limits.

This is a conceptual simulation, not a benchmark or a claim that all older security works this way. Both lanes receive identical attack arrivals. Traditional defense uses exact signature matching against A1, with an analyst reviewing one queued alert per second. Each alert has 2.5 seconds to be handled before intrusion. Mutated signatures bypass this intentionally limited detector.

With automation enabled, the right lane uses an illustrative 96% behavioral detection rate and the selected finite response capacity. Misses and overdue queued threats still breach. All traffic shown is malicious; false positives and legitimate traffic are outside this model. Real signature engines can operate at machine speed, and real defenses combine multiple layers.

Each intrusion infects a system node. Infected nodes lose integrity and spread to adjacent nodes every 2.5 seconds. Analysts can clean one node when their queue is empty; automated containment can clean one every 0.2 seconds when capacity is available. Residual damage recovers gradually after cleanup. These rates are invented to make the contrast visible. Changing controls retains damage; scenario buttons reset both lanes for a fresh comparison.

Teaching sequence: run each numbered scenario for 15–25 seconds. In scenario 3, pause to compare the mutated signatures with the original A1 rule. In scenario 4, reduce automated capacity below attack speed to show that automation also has limits. The guided demo runs four 20-second stages and pauses at the end. Keyboard: Space = pause; R = reset; 1–4 = scenarios. Everything runs locally with no network requests.