What the work actually is.
Four verbs, equal weight. This is not a service catalog.
- Research — questions and programs. Negative findings welcome.
- Engineer — controls and workflows that are observable, measurable, auditable, recoverable.
- Test — lab validation of vendor and internal claims.
- Operationally validate — behavior in realistic conditions, not slideware.
Spine expanded
Endpoint
The device is the control plane: hardware, software, configuration, vulnerability, inventory, operational context. Presence of an agent is not readiness.
EDR
Detection and response as an engineered system (telemetry + enforcement), not a console screenshot. Configuration is not effectiveness.
XDR
Correlation across endpoint and adjacent telemetry. Still evidence-led.
Automation
If X, execute Y, with audit and rollback. Automation is not autonomy.
Agents
Objective-seeking systems that use tools inside bounds. Agents are also secured.
Governed autonomy
Sense → reason → decide → act → verify → learn, under human authority, policy, and safe failure.
Glossary
- Automation
- if X → execute Y.
- Agentic
- an agent receives an objective, interprets context, uses tools, stays inside bounds.
- Autonomous
- continuously sense → reason → decide → act → evaluate, still inside explicit authority, policy, safety, and accountability.
Application control / deny-by-default may appear here as a control class, never as a vendor endorsement.