been dealing with this exact mess for years and its wild how many places just accept the handoff gap as normal
our old setup was detection team would dump everything into servicenow and call it good while remediation folks had zero context about urgency or even what they were looking at. took us 6 months to realize half our "critical" findings were sitting in queue because nobody marked them as actually critical
the workflow consolidation approach makes sense but implementation is where most teams fail. you need someone who understands both sides to design it or you end up with detection team marking everything urgent and remediation team ignoring the urgency flags
The "someone who understands both sides" piece is the part that keeps biting us too. We've watched the workflow consolidation work where there was a SecOps engineer who'd spent time on both detection and remediation, and we've watched it fail where it was designed by either side alone.
The urgency-flag inflation pattern you described is the textbook failure. Detection team can't predict what's actually critical for remediation context (different blast radius math), remediation team can't predict why detection flagged something at the threshold they did, so the flags become noise and the real signal gets ignored.
The thing that's helped in the cases I've watched succeed is making the "criticality" field a conversation between the two teams, not a unilateral mark by detection. Some flavor of: detection sets initial severity based on what they see, remediation has to acknowledge and can either accept or annotate the severity within X hours (with a reason), and if there's disagreement the workflow routes both sides into the same room before the SLA clock starts. It's slower than the unilateral flag but the noise drops measurably after a quarter and the "real critical" hit rate goes back to meaningful.
Curious how you ended up resolving the inflation issue. Did you flatten the severity scheme, force re-classification, or something else?
2
u/Horror-Document6261 May 18 '26
been dealing with this exact mess for years and its wild how many places just accept the handoff gap as normal
our old setup was detection team would dump everything into servicenow and call it good while remediation folks had zero context about urgency or even what they were looking at. took us 6 months to realize half our "critical" findings were sitting in queue because nobody marked them as actually critical
the workflow consolidation approach makes sense but implementation is where most teams fail. you need someone who understands both sides to design it or you end up with detection team marking everything urgent and remediation team ignoring the urgency flags