A managing director we can call Priya once sat through a quarterly review where the security team reported that “78 percent of patches were applied.” Everyone nodded. Nobody asked the question that mattered: which 22 percent was still open, who owned each of those findings, and whether any of them sat on the servers an attacker would reach first. The meeting produced a good feeling and zero decisions. That gap \u2014 between a comfortable number and an actual agreement about who fixes what, by when \u2014 is exactly what SecOps exists to close. Stripped of jargon, it is a working contract between the security team and the operations team, and this piece explains it the way you would explain a supplier agreement: clauses, duties, and how to tell whether the other side is keeping them.<\/p>\n
The word gets used loosely. Some software marketing attaches it to products \u2014 Google even renamed its Chronicle analytics platform “Google SecOps” in April 2024 \u2014 and some organisations use it for the security operations centre, the room where analysts watch screens. Microsoft’s own cloud guidance notes the overlap. The Ops Atlas, a reference site for operations terminology, made an editorial decision to reserve the word for the collaboration itself: its SecOps entry<\/a> describes a contract covering hardening baselines, a single owned remediation queue with deadlines, exceptions that are governed rather than informal, and metrics both departments read together. That definition is the one used through the rest of this piece, because it is the only version a business can actually hold a team to.<\/p>\n A good contract names its duties. These four do most of the work.<\/p>\n Numbers make the contract concrete, so consider one worked month. Across an estate of some size, 240 findings reached their deadline; 198 of them were closed on schedule. That is 82.5 percent overall \u2014 respectable, until the same total is cut by cell, pairing how important an asset is with how urgent the finding was. Internet-facing systems at high urgency came in around 95 percent. Datacentre systems at the same urgency managed only 75 percent, and the reason was findable: that group had no agreed change window for security work, so fixes queued behind routine releases. Same estate, same month, two very different stories \u2014 and only the per-cell view tells the second one.<\/p>\n The rest of that scorecard is just as instructive. Eighteen of six hundred findings had no owner at all \u2014 three percent of the register drifting with nobody attached. Six of thirty-five recorded exceptions had sailed past their review dates. Telemetry coverage stood at 1,540 of 1,600 machines reporting their logs, and the sixty silent ones traced back to a recently acquired subsidiary nobody had scanned. And the disruption counter \u2014 security changes that broke something \u2014 recorded three incidents out of 120, every one traced to a single estate-wide baseline that had been pushed everywhere without a pilot ring. Each of those five numbers points at a clause of the contract, which is precisely the point.<\/p>\n The number in Priya’s meeting fails for a documented reason: NIST rejects estate-wide “percent patched” reporting as not actionable, because an average tells you nothing about which cells are bleeding. The measures that do support decisions are cut per cell \u2014 asset importance crossed with urgency \u2014 and track the share of findings closed on time, plus the clock on repairs \u2014 how long the typical one takes and how long the slowest tenth ends up waiting. Around those, a healthy scorecard adds the counts a contract needs: findings sitting ownerless this week, exceptions overdue for review, how much of the estate reports its logs, and the tally of security changes that broke something. One more habit to avoid: rewarding closed-ticket counts. A team measured on tickets closed will split and reclassify work to look busy, and the queue will lie to you politely.<\/p>\n You do not need an engineering background to audit the agreement. Ask for these five things and watch what happens.<\/p>\n Teams with a real contract answer those questions from a screen in minutes. Teams without one schedule another meeting to prepare the meeting. That difference tells you everything about which kind you have \u2014 and if you want the infrastructure side of the story, the pieces on digital growth planning<\/a> and building enterprise digital resilience<\/a> cover how these agreements fit wider technology strategy, alongside this guide to navigating business technology solutions<\/a>.<\/p>\n Priya’s next review went differently. Same estate, same month, but the report opened with the two cells that missed, the named obstacle for each, and a date to fix the missing change window. Nobody had to ask what the number meant. That is what the contract buys: not better percentages, but numbers that end meetings with decisions.<\/p>\n","protected":false},"excerpt":{"rendered":" SecOps explained for people who run businesses: the four clauses that matter, a worked monthly scorecard, and the questions that expose a hollow programme.<\/p>\n","protected":false},"author":6,"featured_media":1083,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[166],"tags":[],"class_list":["post-1082","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-business-technology"],"_links":{"self":[{"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/posts\/1082","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/comments?post=1082"}],"version-history":[{"count":1,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/posts\/1082\/revisions"}],"predecessor-version":[{"id":1095,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/posts\/1082\/revisions\/1095"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/media\/1083"}],"wp:attachment":[{"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/media?parent=1082"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/categories?post=1082"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/tags?post=1082"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The SecOps clauses worth having in writing<\/h2>\n
\n
Reading a SecOps scorecard without a translator<\/h2>\n
Why “percent patched” flatters to deceive<\/h2>\n
Questions to bring to your next review<\/h2>\n
\n