The Ocsf Migration Nobody Warned You About

Every enterprise security team now serves two masters: the attackers and the auditors. SOC 2, ISO 27001, PCI DSS, DORA, HIPAA — each framework wants proof that monitoring exists, that alerts are investigated, that incidents follow procedure, that access reviews happen. Assembling that proof is a quarterly scramble of screenshots, CSV exports, and reconstructed timelines, performed by the same senior people who are supposed to be hunting threats.

The dirty secret is that most of this evidence is theatre. A screenshot of a dashboard proves the dashboard existed on the day of the screenshot. It says nothing about whether the alert at 3 a.m. on a Sunday in February was actually worked, by whom, and on what basis. Auditors accept it because nothing better is usually available, and everyone in the room quietly knows it.

Regulators are tightening. DORA and the SEC disclosure rules ask for operational reality, not intent — how fast incidents were detected, classified, reported. That standard cannot be met retroactively with screenshots. It requires an operating model where every detection, verdict, and response action generates its own tamper-evident record as a by-product of doing the work, not as a separate documentation exercise.

The global shortfall of security professionals is estimated at around four million people, and the gap widens every year. For enterprises outside the tech-salary tier — hospitals, manufacturers, regional banks, public agencies — the practical reality is that senior detection engineers and experienced responders are effectively unhirable. The job postings stay open for nine months and then get quietly rewritten to junior level.

So the industry props itself up on outsourcing, and the maths of shared-service MDR asserts itself: one provider analyst covers many clients, so the analyst who catches your incident at 4 a.m. has never seen your environment, does not know your naming conventions, and escalates with a generic ticket that your on-call engineer must re-investigate from scratch. You have outsourced the alert, not the understanding.

The uncomfortable strategic conclusion is that any operating model whose scaling unit is 'experienced human' is structurally broken for the next decade. The only inputs that scale are compute and context. The enterprises getting ahead are the ones re-basing their SOC on those inputs and reserving their scarce humans for judgment, governance, and the genuinely novel.

Enterprises that give up on in-house coverage buy MDR, and most discover the same frustration within a year: the service is a black box. Alerts go in, closed tickets come out, and the reasoning in between is invisible. When the quarterly report says '14,000 alerts triaged, 12 escalated', there is no way to verify that the 13,988 closures were sound. You are asked to trust, without evidence, the same category of overloaded human analyst you were trying to escape — just employed by someone else.

The contract structure makes it worse. Response actions require a phone call and a change window. Data lives in the provider's tenant, so leaving means losing history. And when an incident does slip through, the post-mortem devolves into a liability negotiation between your counsel and theirs about what 'detected' means in schedule 3 of the SLA.

None of this means managed outcomes are the wrong goal — 24/7 coverage without building a night shift is exactly what most enterprises need. The failure is opacity. A managed detection function is only trustworthy if every verdict it renders arrives with its evidence attached: the questions asked, the answers found, the weights applied. Transparency is not a nice-to-have in MDR; it is the entire difference between a service and a liability shield.

Somewhere between the SOC floor and the boardroom, security information degrades into decoration. The team works in findings and indicators; the board wants exposure, trend, and dollars. The translation layer is usually a slide deck assembled the night before the risk committee, cherry-picking metrics that are easy to extract rather than metrics that are true: alert counts (meaningless), phishing click rates (noise), patching percentages (stale on arrival).

The metrics that would actually inform a capital-allocation decision — time from detection to verdict, percentage of alerts investigated to conclusion, containment time by asset criticality, false-positive trend by detection — are precisely the ones a human-queue SOC cannot produce honestly, because producing them would document the backlog. Nobody presents a slide that says 'we investigate 40 percent of what we detect'.

This is how boards end up approving eight-figure security budgets on vibes and fear. The fix is not better slide design. It is an operational system where every alert reaches a recorded verdict, so the numbers reported upward are queries against reality rather than curated samples of it.

The modern enterprise attack surface is not a network edge; it is a directory. Tens of thousands of human identities, and — increasingly — multiples more non-human ones: service accounts, API keys, CI runners, and now AI agents with standing credentials. Attackers noticed years ago that stealing a valid credential beats exploiting a vulnerability: no malware, no exploit signature, just a login that looks almost right. The majority of serious cloud incidents now begin with a compromised identity, not a compromised host.

Almost right is the operative phrase. A stolen credential logs in from a slightly wrong place, at a slightly wrong hour, and touches resources slightly outside its habit. Each signal alone is dismissible — which is exactly why rule-based detection drowns: the rules fire on travellers and contractors all day, and the SOC tunes them down until the real one sails through.

Catching identity abuse requires knowing each identity's normal — its hours, geographies, volumes, and peer group — and evaluating every anomaly against that baseline in context. That is a per-entity statistical problem multiplied by a hundred thousand entities, refreshed continuously. No human team maintains that. It has to be computed.

Every enterprise has automation it is afraid to turn on. The SOAR playbook that could disable a compromised account runs in 'create a ticket' mode, because the one time it ran for real it locked out a departmental VP during quarter close. The lesson organisations draw — automation is dangerous — is the wrong lesson. The right one is that automation without graduated governance is dangerous.

The change board's questions are legitimate: What exactly will this action touch? What happens if the verdict is wrong? Who approved this scope, and how do we undo it? Most automation platforms answer none of these. They offer a run button and a log, which is why enterprise response automation stalls at sending notifications while actual containment still waits for a human with production access and a change ticket.

Closing the gap requires treating autonomy as something earned per action class, not granted globally: recommend-only until precision is proven, approval gates where blast radius warrants, dry-run previews before anything writes, rollback state recorded for everything reversible, and a kill switch that stops it all instantly. With those primitives, automation stops being a leap of faith and becomes a controlled delegation — which is the only form of delegation an enterprise should accept.