Finance refuses the broker upgrade: how do you state the peak blind window an intruder could cross so an owner can sign for it?
answer
- coverage of the fabric, not alert counts
- name the window, name the hour
- concede the peak-sizing economics
- random discard versus chosen discard
- a trigger threshold, not a review date
basics
~20 sExpress it as fabric coverage in a named time window, not as alert counts: at the busy hour we deliver only part of the mirrored traffic to the sensors, so a stated share of it is uninspected. Then convert random loss into chosen loss with a named owner and a review trigger.
solid answer
~60 sStop arguing in security language. State the shortfall as delivered capacity against offered capacity in the peak window — for example, the aggregation stage can carry a given rate and the busy hour offers substantially more, so a measurable share of mirrored traffic is never inspected between the hours the batch and replication load runs. That is a sentence a business owner can weigh, and it names the window in which bulk data movement is least remarkable and therefore most attractive to an intruder staging an archive. Then offer the real choice rather than a demand: fund the headroom, or let me choose the loss. Deterministic filtering at the aggregation stage — excluding known bulk replication and backup flows so the remainder is fully inspected — costs nothing and converts an invisible random discard into a documented coverage decision. Whichever they pick, get a named owner to accept the residual, set a growth trigger that reopens it, and keep the trend so the next budget round argues from a curve rather than a claim.
go deeper
Know that monitoring capacity is a funded line item and that a shortfall is stated as how much traffic reaches the sensors, not as how many alerts fired.
Be able to produce the numbers: what the monitored links carried at peak against what the aggregation stage and sensor ports could carry, and the share that difference represents.
Show that deterministic filtering converts random invisible loss into a documented coverage decision, and be able to say which flow classes you would sacrifice first and why.
Own the whole decision: a bounded coverage statement, two fundable positions, a named business owner who accepts the residual, and a growth threshold that reopens it automatically.
## Why the security framing loses this argument A request phrased as *we need a bigger packet broker or we might miss an attack* asks a finance owner to price an unbounded, unquantified fear against a concrete number. They will decline, and they are not being unreasonable. The winning move is to give them a quantity they can compare and a decision they can own. ## The quantity: coverage of the fabric, in a named window The honest metric on this leaf is delivered against offered, at peak: - What the monitored links carried in the busiest hour (available from ordinary switch interface counters, which nobody disputes). - What the aggregation stage and the sensor ports could carry in that hour. - The difference, expressed as a share: *in the busiest hour a stated proportion of mirrored fabric traffic is discarded before any sensor sees it, and the discard is random with respect to which conversation it belongs to.* Two properties of that sentence make it fundable where the previous one was not. It is bounded — it does not claim total blindness, and overclaiming is what destroys credibility on the second visit. And it names a window: the batch, backup and replication peak. That is exactly the period in which a large transfer out of a data tier looks like the rest of the night's traffic, so the coverage gap and the attacker's preferred hour are the same hour. State that connection explicitly; it is the part that carries the risk rather than the arithmetic. ## Peak sizing is the actual dispute Finance's real objection is rarely the total. It is that you are asking for capacity used at full stretch a small fraction of the year. That objection is correct on the economics and wrong on the risk, and you should concede the first half out loud. Monitoring capacity is sized for the busiest hour for the same reason a fire exit is sized for the fullest room: the average is not what you are protecting against. Sizing against the mean guarantees the blind window sits precisely where the interesting traffic is. ## Offer the choice, do not repeat the demand This is the move that separates a principal answer from a senior one. Present two fundable positions: | Position | What it delivers | What is given up | | --- | --- | --- | | Fund the headroom | Full mirrored coverage through the peak | Capital and per-port licensing for capacity idle most of the year | | Choose the loss | Full inspection of the remainder, deterministically | Named flow classes go uninspected, permanently and on the record | The second position is close to free and is a genuine improvement even though the same number of bits go uninspected. Deterministic filtering at the aggregation stage — excluding identified bulk replication or backup flows — replaces a random discard nobody chose with a coverage decision that has a rationale, a scope and an owner. It also makes the residual risk describable: *storage replication between these two segments is not inspected* is a statement someone can accept or refuse, where *roughly a third of everything at peak, we cannot say which third* is not. ## Close it like a risk decision, not a purchase request - **A named accountable owner** who can actually accept it — the person who owns the systems in the affected segments, not the security team accepting risk on everyone's behalf. Security owning its own residual risk is the classic way a gap becomes permanent. - **An explicit statement of what is given up**, in the coverage language above, written where it will be read again. - **A trigger, not a date.** Traffic grows; the gap widens without anybody deciding anything. Tie the review to a threshold — when peak offered load crosses a stated level — so the decision reopens automatically rather than depending on someone's memory in eleven months. - **Keep measuring.** Collect the stage counters through the year so the next budget conversation opens with a curve showing the gap widening, which is a far stronger position than repeating last year's request. ## What not to do Do not go quiet and let the sensor's clean dashboards imply coverage that does not exist — a healthy-looking sensor with zero drops on a starved feed is a misleading artefact and you now know it is misleading. Do not escalate over the owner's head on a decision that is legitimately theirs to make. And do not treat the refusal as final in the wrong way: an accepted, documented gap that someone signed for is a working outcome, and it is a far better one than an unfunded gap that only the network team knows about.
- Why is deterministic filtering an improvement if the same volume still goes uninspected?Because the residual becomes describable and owned. A random discard means you cannot say which conversations were missed, so you can neither bound the risk nor reason about it. Excluding a named flow class means everything else is inspected completely and the gap has a rationale, a scope and someone who accepted it. The bit count is unchanged; the quality of the risk statement is entirely different.
- Who should sign the residual risk, and why not the security team?The owner of the systems in the affected segments — someone with the authority to fund the alternative and the exposure if it goes wrong. When security accepts risk on the business's behalf, the gap stops being visible to anyone who could resolve it and quietly becomes permanent. Security's job here is to state the gap accurately and make refusing it a conscious act, not to absorb it.
- What makes a review trigger better than an annual review date?Traffic grows continuously while the aggregation capacity is fixed, so the gap widens with no decision being taken. A threshold on peak offered load reopens the decision at the moment the accepted position stops being the one that was accepted. A date depends on someone remembering, and by then the gap is materially larger than the one that was signed for.
saying these in an interview costs you the question
- Argues the budget in alert counts or rule numbers
- Claims total blindness when the gap is partial
- Sizes monitoring capacity against average utilisation
- Has security accept the residual risk itself
- Leaves an unfunded gap undocumented and unowned