Sub-function
Cybersecurity Operations
Owns alert work end to end inside Information Technology. Runs 3 lines across 21 stations, drains the repeatable share into the AI-OPS tower, and holds 6 human gates.
Estate rating
A
79 / 100
Triage, enrichment and in-policy containment run in seconds because speed is the control. Declaring a major incident and any external notification are human acts.
Agents
9
Lines
3
Units / wk
10,535
Timetable vs actual
8.0h → 8.2h
Cost / unit
$5.44
was $19
Run-rate saving
$7.5M
annualized at this volume
The 9 agents running this sub-function
Grouped by what they are for, not by where they sit. The agent org is process-shaped.
Security Operations Orchestrator
Owns the cybersecurity operations lane end to end. Sequences the other agents, holds the timetable, and decides what surfaces to a human.
ceiling A3 · escalates to Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Alert Triage Agent
Runs the repeatable portion of cybersecurity operations inside the shared transaction spine at spine cost and spine controls.
ceiling A3 · escalates to Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Forensics Support Agent
Runs the repeatable portion of cybersecurity operations inside the shared transaction spine at spine cost and spine controls.
ceiling A3 · escalates to Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Threat Intelligence Agent
Executes the cybersecurity operations step it owns, posts its evidence, and hands the unit to the next stage.
ceiling A3 · escalates to Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Containment Agent
Executes the cybersecurity operations step it owns, posts its evidence, and hands the unit to the next stage.
ceiling A3 · escalates to Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Phishing Response Agent
Executes the cybersecurity operations step it owns, posts its evidence, and hands the unit to the next stage.
ceiling A3 · escalates to Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Vulnerability Agent
Executes the cybersecurity operations step it owns, posts its evidence, and hands the unit to the next stage.
ceiling A3 · escalates to Escalates to Director, Security Operations when the unit falls outside the decision envelope or confidence drops below the floor.
Security Policy Agent
Holds the rules that bind every other agent in cybersecurity operations. Versions them, tests them against live decisions, and blocks work that breaches them.
ceiling A3 · escalates to Escalates on any decision that would breach a live policy version, with the clause cited.
Cybersecurity Operations Challenger Agent
Adversarial reviewer for cybersecurity operations. Argues the opposite case on every position and flags where the evidence does not carry the claim.
ceiling A3 · escalates to Escalates when a ratified position is still running against a break condition it flagged.
Estate rating breakdown
Seven control dimensions. Judgment readiness runs against autonomy on purpose.
People
What the humans stopped doing, and what they do now.
Redeployed into cross-function process redesign.
Lines running in this sub-function
Each line is a workflow. Click a line to walk it station by station.
Strategy positions this sub-function holds
An agent that only executes is a robot. These are the calls it made, the argument against each one, and what would prove it wrong.
Cybersecurity Operations Operating Position
Ratifiedv2What operating shape carries twice the current alert volume without adding headcount, and what breaks first if we are wrong?
Hold the ceiling at A3 for cybersecurity operations. Triage, enrichment and in-policy containment run in seconds because speed is the control. Declaring a major incident and any external notification are human acts. Raise it only after two consecutive quarters where the override rate stays under five percent and every override has a written cause.
confidence
74%
The challenge — Cybersecurity Operations Challenger Agent
Cybersecurity Operations Challenger Agent argues the recommendation leans on 2 quarters of data from a period with no volume shock. The confidence band overlaps the alternative, and the position does not say what it would take to be wrong. Recorded as a dissent, not a block.
Break conditions
- ·Override rate rises above 9 percent for two consecutive months
- ·Cost per alert stops falling while volume keeps rising
- ·A control failure in this lane reaches a customer or a regulator
Evidence gaps
- ·No external comparator on a like-for-like unit definition
- ·Exception cases under $31k are sampled, not fully measured
| Alternative considered | Cost | Risk | Verdict |
|---|---|---|---|
| Hold the current position | $447k run rate | Known and priced. Cedes ground if comparators move faster. | not selected |
| Raise the ceiling one level now | $306k to build controls | Override rate is 10 percent; raising the ceiling before that settles imports the error into production. | rejected on evidence |
| Move the exception tail to the spine | $340k transition | Loses local context. Rework risk on the cases that are hardest to recover. | selected |
Ratified 8 months ago. Measured since: cost per alert fell 6 percent against a forecast of 10 percent.
Policy register
The rules the agents above are bound by. Version, owner, approver, and the agents each rule constrains.
| Ref | Rule | Scope | Owner agent | Approved by | Version | Status |
|---|---|---|---|---|---|---|
| IT7-POL-200 | Cybersecurity Operations Decision Envelope Agents in this lane may act without a human when the alert sits inside the stated value, risk and confidence envelope. Outside it, the unit holds at a gate with a named approver and a running clock. binds 6 agents · LATAM · US | envelope | Security Policy Agent | Director, Security Operations | v4.6 | Active |
| IT7-POL-201 | Cybersecurity Operations Evidence Standard Every autonomous decision writes inputs, the rule version applied, the model and prompt version, the output and a reversal path. An action with no evidence record is treated as a control failure, not a fast decision. binds 6 agents · US · Canada | evidence | Security Policy Agent | Director, Security Operations | v3.7 | Active |