When a protection goal is violated, how quickly is the violation typically detected — and why does this differ per goal?

Availability is noticed immediately; integrity/authenticity fairly soon; confidentiality often late or never.

Why this asymmetry matters: the worst breaches are confidentiality breaches precisely because they're invisible — copying data leaves the original untouched. This is the security version of "you can't tell someone read your letter if they put it back." It's also the argument for detective controls (logging, DLP, anomaly detection) on top of preventive ones.