Security: Workflows
What security watches, what it issues, the detection to response path with its approval gate, and the handoffs with Engineering, DevOps, Legal and HR.
Markdown. No sign-up, no email.
Security is the only function here that is adversarial. Everything else optimises against indifference; this one operates against someone who is reading the same playbook and looking for the gap in it.
That changes the design. Every automated capability is also a capability an attacker may try to trigger.
What arrives#
| From | What | Becomes |
|---|---|---|
| Every system | Logs, network, identity, endpoint telemetry | The baseline and its departures |
| Cloud providers | Configuration state | Drift findings, which cause most cloud incidents |
| Scanners | Vulnerabilities | Work, prioritised by exposure rather than by score |
| Threat intelligence | What is being used right now | Detection rules and hunting hypotheses |
| Engineering | Deploys and changes | Context that separates an incident from a release |
| Anyone | A report of something odd | An event, always investigated |
The last row matters more than it looks. The cheapest detection in any company is a person saying "this email looks wrong". Making that easy and never punishing a false alarm is worth more than most tooling.
What leaves#
| To | What |
|---|---|
| Engineering | Vulnerabilities with exposure context and a deadline |
| DevOps | Configuration drift and hardening work |
| Legal | Anything touching customer data, immediately |
| HR | Anything involving an employee, through HR and never around them |
| CEO | Confirmed compromise, and the risk decisions that need owning |
| Knowledge Management | Postmortems, minus anything that is itself sensitive |
The path#
Detection, AI analysis and risk scoring are automated. Response is not, until a person approves it. The approval gate is described in the agents page and is the single most important element of the design.
Handoff contracts#
With Engineering. Findings arrive with exposure context and a deadline, not a raw scanner dump. A dump of four hundred findings is not a handoff; it is a way of transferring the triage problem to people with less context.
With DevOps. Security findings are never automatically remediated by the operations allowlist. Changing an access policy in response to an anomaly is precisely how an attacker gets a system to lock out its own operators.
With Legal. Anything involving customer data goes immediately, not once it is confirmed. Notification clocks in most regimes start at awareness of a possible breach, and "we were still investigating" is not a defence.
With HR. Anything involving an employee goes through HR from the first minute. Investigating a person without them is a legal and human problem that outlasts the technical one.
With the Board. Confirmed compromise goes up the same day, with what is known, what is not, and what has been done. Partial information delivered early beats a complete picture delivered late.
Cadence#
| Continuous | Detection, correlation, scoring |
| Daily | High-risk events, approval latency, alerts closed without investigation |
| Weekly | Vulnerability ageing, tuning from false positives |
| Monthly | Exposure review, coverage reconciliation, exception register |
| Quarterly | Access review, response allowlist, tabletop exercise |
The failure this design is built against#
Two, and they pull in opposite directions.
The first is a team so buried in alerts that everything is closed by clicking, and the real intrusion is closed alongside the noise. That is what correlation, scoring and the closed-without-investigation metric exist to prevent.
The second is the fix for the first taken too far: automated response with no human in it, which an attacker can eventually aim at the company itself. The approval gate exists for that, and keeping it fast is what stops someone removing it for entirely reasonable operational reasons.