Sixty Percent of Alerts Never Closed
Vantage Health has 4,500 staff. VPN MFA is deployed, but the 900-user legacy ERP uses local accounts and cannot support MFA before a 2027 platform migration. Last quarter's phishing simulation produced a 22% click rate in finance, roughly double the enterprise average. The SOC - four analysts - receives about 1,200 alerts per week; 60% are never closed, and analysts report that most are false positives from a misconfigured EDR policy. The CFO has asked the CISO to show measurable improvement within two quarters, and the FY budget is being set now.
1. With limited headcount and a two-quarter horizon, where should the CISO focus first?
Read the worked answer
Start with the item that degrades every other control: the alert pipeline. A SOC closing 40% of 1,200 weekly alerts is not detecting - it is generating a false assurance that detection exists. Tuning the misconfigured EDR policy is cheap, immediate, and multiplies the value of the four analysts already employed.
Then prioritise by path to the most damaging outcome, not by project appeal:
- Finance phishing (22% click rate) sits directly in front of payment fraud and BEC, which is a plausible, high-frequency loss. Targeted simulation, payment-change callback procedures, and mailbox rules are low-cost and fast.
- ERP local accounts are the highest-severity structural gap, but the fix is a 2027 platform, so the realistic play in two quarters is compensating control, not remediation: privileged account inventory, session logging, network restriction to admin interfaces, and a monitored exception.
Avoid opening a new initiative that cannot show a result before the budget decision - the CISO needs one credible win and one honest structural gap on the record.
2. How should the ERP exception be governed so it does not simply become permanent?
Read the worked answer
An exception without a clock is a decision to keep the risk forever. Structure it as a controlled exception:
- Named business owner for the ERP (likely finance or operations), who accepts the residual risk in writing - not the CISO.
- Compensating controls specified and testable: privileged account inventory with periodic review, admin-interface network restrictions, session logging with alerting, and a defined review cadence.
- Expiry tied to the migration plan, with interim milestones (e.g., MFA-capable front end or SSO gateway before 2027) that are checked each quarter.
- Re-review trigger: any suspected credential compromise, or slippage of the migration date, reopens the acceptance automatically.
The CISO should also make the exception visible in reporting to the CFO and risk committee, because the pressure that keeps a 2027 date honest comes from outside the security function. Unowned exceptions age into permanent architecture.
3. What should the CISO report to the CFO as measurable improvement after two quarters?
Read the worked answer
Report outcomes tied to the risks the CFO cares about, not activity counts. Ticket volume, alerts triaged, and training completion rates are easy to move and prove nothing.
Defensible measures after two quarters:
- Alert backlog and mean time to close on the tuned pipeline - e.g., unclosed alerts falling from 60% to a defined target, with a measurable drop in false-positive volume.
- Finance phishing susceptibility on a follow-up simulation, reported alongside the trend, not a single number.
- Payment fraud control coverage - percentage of payment-change requests that passed a verified callback.
- ERP exception status: controls implemented and verified, milestones met against the plan.
Pair every measure with its residual risk narrative, and state plainly what has not improved. A CFO who is told only good news stops funding; a CFO who sees a credible scorecard with one honest gap typically funds the gap. The two-quarter horizon also means the CISO should agree the measures with the CFO up front, so improvement is judged against a target set before the results are known.