SOC Model Under Alert Fatigue and Ransomware Risk
You are CISO at a 12-hospital healthcare system with 18,000 employees and 9 security FTEs. The outsourced SOC ingests 1,800 alerts per month. Last quarter, 34% were false positives, mean time to detect was 6 hours, and mean time to respond was 72 hours. A ransomware incident on a billing server was contained after 14 hours; the root cause was an unpatched VPN appliance. The board asks whether to insource the SOC, buy automation, or add headcount. The MSSP contract is $1.4M annually and expires in 8 months. Your team spends 60% of its time on alert triage and 15% on strategic projects. The CFO wants a 10% reduction in security spend next year. The CMO is concerned about patient safety and media coverage.
1. Assess the operating model and recommend an option.
Read the worked answer
Do not treat this as a binary choice between insourcing and outsourcing. The current model is failing because triage consumes 60% of a nine-person team and detection and response times are too slow for ransomware risk. A hybrid model is the most defensible: keep the MSSP for 24/7 monitoring, renegotiate SLAs, and invest in automation to reduce triage volume. Insourcing all 24/7 coverage would require roughly 12 to 15 additional FTEs and likely cost more than the current contract, while adding recruiting and retention risk.
Recommendation: extend the MSSP for 12 months with revised terms, require the MSSP to use automated enrichment and detection rules, and set measurable MTTD and MTTR targets. Internally, deploy SOAR and EDR automation for tier-1 triage and shift the team toward tier-2 response, vulnerability management, and recovery readiness. If the CFO requires a 10% reduction, fund automation from MSSP renegotiation and tool consolidation, not from cutting response capability. Present the trade-offs explicitly.
2. Which metrics should you present to the board, and which should you stop using?
Read the worked answer
Present metrics that connect security to hospital operations and risk:
- Percentage of critical assets with EDR and logging coverage.
- Mean time to detect and contain critical incidents, not all alerts.
- Patch latency for internet-facing systems such as VPN appliances.
- Ransomware recovery time objective and tested restore success rate.
- Percentage of alerts auto-triaged and percentage escalated to tier 2.
- Cost per protected endpoint and cost per critical incident.
- Open critical vulnerabilities by age and business owner.
Stop using raw alert volume as a success metric. High alert counts can indicate poor tuning, and false-positive rate alone can incentivize under-reporting. Also avoid presenting only tool uptime. The board should see risk trends, response readiness, and whether patient-care systems are exposed. Use a simple risk dashboard with thresholds and explain what changed since the last report.
3. How should you handle the CFO's 10% reduction request?
Read the worked answer
Respond with a risk-based budget, not a blanket cut. Show the cost of downtime in a 12-hospital system, regulatory exposure, and patient-safety impact. Identify efficiency savings: renegotiate the MSSP contract, consolidate overlapping tools, automate tier-1 triage, and eliminate low-value subscriptions. These can plausibly produce part of the 10% without reducing critical capability.
If the CFO still requires a full 10% cut, present options with residual risk: reduce strategic projects, defer non-critical tooling, or reduce MSSP coverage. Require written risk acceptance from the CFO and CEO for any option that lowers detection or response capability. Do not silently absorb the cut by overworking the nine-person team, because that would worsen turnover and incident response. The CISO's role is to make the trade-off explicit and ensure the business owns the consequence.