The catalogue EngineeringSecurity EngineeringTransactional

Service EN10B

Secret Exposure Response

Runs transactional. Starts when an upstream system posts an event. It runs 4,241 times a week across 6 stations. 2 of those stations stop for a person and 4 are done by an agent, 3 of them on the shared spine.

Runs a week

4,241

92 in flight right now.

Stations

2 person · 1 agent · 3 spine

Agent share of steps

67%

Autonomy on this service is set at 72% against a ceiling of 82%.

Decisions a person makes

Held by Director, Security Engineering.

Touchless

80%

Share of runs that complete without anybody opening them.

Timetable against actual

13.8h

Actual 15.2h, 1.4h over the timetable.

Operations

The lane diagram

Read it left to right. more

Person2 stations and 51% of the dwellAgent1 station and 5% of the dwellShared spine3 stations and 44% of the dwell4 crossings between lanes

Human

decides

Agent

does the work

GBS

shared spine

System

attributed by rule

Group ERP — Materials and Inventory

Configuration Management Database

Group ERP — Materials and Inventory

Click any station to see who does it, what it costs in time, the rule that gates it and the system attributed to it.

Operations

Every station in order

The same stations as a list, with the dwell the estate records against each one and the system a station of that shape would touch.

#	Station	Lane	Who	Layer	Dwell	Target	In flight	System
1	Detect	GBS	Vulnerability Scanning Agent	gbs	2h 34m	4h 56m	21	Group ERP — Materials and Inventory
2	Revoke credential	GBS	Vulnerability Scanning Agent	gbs	1h 53m	3h 25m	6	Group ERP — Materials and Inventory
3	Notify Held for a named human when the unit exceeds the finding decision envelope, when confidence falls below the floor, or when a policy clause is engaged.	Human	Director, Security Engineering	policy	3h 33m	4h 14m	6	Group ERP — Materials and Inventory
4	Rotate	GBS	Vulnerability Scanning Agent	gbs	1h 36m	2h 6m	25	Group ERP — Materials and Inventory
5	Investigate	Agent	Patch Orchestration Agent	workflow	39m	1h 10m	30	Configuration Management Database
6	Close Held for a named human when the unit exceeds the finding decision envelope, when confidence falls below the floor, or when a policy clause is engaged.	Human	Director, Security Engineering	policy	3h 28m	4h 6m	4	Group ERP — Materials and Inventory

Operations

Run it

Change the volume, move the autonomy line, release a gate, and watch what happens to the hours in each lane and to the time it takes one run to get through. more

Move something

Demand100%

4,241 a week is what the estate records. more

Decisions handed to agents0 of 2

Cheapest decision first. The last gate never moves: something on this service always ends with a person.

People on the gates851 people

Each one is assumed to have 2,100 productive minutes a week, which is 35 hours.

Agent speed100%

100% is the dwell the estate records today. more

Person time a week

29,757.7h

4,241 items at 421 minutes of decision each.

Agent time a week

28,414.7h

402 minutes an item, which does not compete for a person.

Gate load

100%

Inside capacity, with 27.3h of headroom.

Stations without a person

67%

2 gates left on 6 stations.

Where an item spends its time

51% waiting on a person

49% in the agent lane

An item now takes 823 minutes of worked time end to end against 823 in the recorded estate, a change of +0%. This is worked time, not calendar time: nothing here models a queue or a weekend.

What this model is, on Secret Exposure Response

The simulation is arithmetic on the estate, not a queueing model. more

How it runs

Run it again, going wrong

The same unit and the same stations, broken the way the estate already records breaking. more

6 stations, walked twice

Once clean, once with the categories the estate counts

This is the same unit on the same stations, breaking. more

No break below was chosen. more

One play head, two tracks, the same scale. The clean run stops when it runs out of stations; the other one keeps going.

As written

6 stations, nothing waiting, nothing sent back

0 min of 14 hrs

now Detect · Vulnerability Scanning Agent · 2.6 hrs

As the ledger has it

the same stations, plus 3 categories the estate already counts

0 min of 30 hrs

now Detect · Vulnerability Scanning Agent · 2.6 hrs

personagentshared spinework the break addsnobody working it

What breaks, and where it is counted

No break below was chosen. more

What the two runs say together

3 counted categories land on this procedure. more

What this run cannot claim

These breaks are shown together on one unit so the shape of a bad day fits on one screen. more

Two clocks run. Worked time is the sum of the time the work is actually being done … more

Live observability

Systems this service would touch

Attributed by rule from the function's system list. more

2 systems attributed

0 of 2 returning records

The system register

Group ERP — Materials and Inventory

SAP S/4HANA MM · supply · bidirectional · high

modeled

5 of 6 stations attributed here · would write back

Configuration Management Database

ServiceNow CMDB · itsm · inbound · high

modeled

1 of 6 stations attributed here · read only

System attribution is a rule, not a reading. more

Who runs it

Orchestration and accountability

Orchestrated by: Security Engineering Orchestrator
That orchestrator’s remit: Owns finding work end to end inside Engineering. Runs 3 lines across 19 stations, drains the repeatable share into the IT tower, and holds 4 human gates.
Accountable person: Director, Security Engineering
Sub-function: Security Engineering
Shared spine tower: it
Hand-over points: None — this service stays inside its function

Other services in this sub-function

2 alongside this one

Vulnerability RemediationEN10A Threat Model ReviewEN10C

What this page is and is not

This is a catalogue of the modeled estate. more