Why is Detection called the first and most important step of incident management, and what is required to do it well?

You can only respond to what you can see, so detection needs clear criteria, a defined process, and sensors covering the whole IT landscape to create visibility.

If a problem is never recognised, none of the later steps ever start — that's why detection is the foundation. Good detection rests on three kinds of sensors: Technical sensors (Endpoint Detection and Response / Network Detection and Response — EDR/NDR — and SIEM, the Security Information and Event Management system that aggregates and correlates logs); "Human" sensors (your own employees — the "human factor" who notice and report odd behaviour); and Third-party sensors (good relationships with partners, vendors and suppliers who may warn you first).