How it works
From signal to response.
Five steps. The value is concentrated in the middle two, which is where most monitoring stops.
- Observe
- A change occurs in a system the organisation has connected. Nothing outside that authorised boundary is in view.
- Qualify
- Is this the kind of change that matters here? Most changes are not, and saying so confidently is what keeps the rest readable.
- Add context
- Who did it, whether it was expected, what it affects, and how it relates to other recent activity.
- Route to an owner
- To a named person or team with the standing to act, carrying what changed, why it matters and the safe next step.
- Record the outcome
- Reverted, accepted or escalated. The decision becomes part of the record, which is what makes the next one faster.
What this is not
Worth being direct about, because the category is crowded.
Not a log store
Where you already collect and retain telemetry, keep doing that. This is about what gets acted on, not what gets kept.
Not a replacement analyst
Decisions that need judgement still need a person. The work is making sure the right ones reach them with enough context.
Not unbounded visibility
Nothing outside the systems an organisation connects is observed. Expanding scope is a decision, taken deliberately.
Not available yet
Vigilance is in development. The design work described here is real; the product is not something you can buy today.
Want to walk through it against your environment?
Bring the change you would most want to hear about, and the reason nobody currently does.