Budget funds interior sensors on one segment in five: how do you choose, and what do you tell an auditor about the segments an intruder could cross unseen?

## What is actually being asked for An auditor, an insurer or a customer's security team does not want your architecture. They want an answer to one question, per segment: **if it happened only here, would any record exist?** With funding for one segment in five, the honest answer is "no" for most of the estate, and the professional act is to say so precisely rather than to imply coverage you do not have. So the output of this programme is a **dated list of what is not sensed**, maintained like an asset register. That is a different artefact from a deployment plan, and treating it as the deliverable changes how you choose. ## Choosing the fifth Ranking by traffic volume is the reflex and it is wrong — the loudest segments are usually replication and telemetry. Better inputs: - **Consequence of a contained intrusion.** What can an intruder reach if their whole path stays inside this segment? A segment holding a data store and its clients is a complete objective; a segment of stateless front-ends is a waypoint. - **Management and credential paths.** Segments carrying administrative access, secret distribution or build and deployment traffic are where a lateral path becomes an estate-wide one. - **Marginal evidence, not absolute evidence.** If a segment already produces strong host or application records, network sensing adds less than it does where the workloads are opaque appliances or third-party images that carry no other telemetry. Spend where the alternative is nothing. - **Node density.** A capture point on a dense node converts more otherwise-invisible traffic into observable traffic than one on a sparse node. - **Rate of change.** A segment that is rebuilt weekly makes any static claim about it stale faster. ## Tier instead of choosing binary "One in five" is a budget, not a design. Three tiers usually beat a binary split: | tier | what exists | roughly | | --- | --- | --- | | full | inner packets, inspected | the chosen fifth | | reduced | connection-level records only, no payload | a wider band, cheap on the node | | none | nothing — stated explicitly | the remainder | The reduced tier is what lets you shrink the "none" list without new budget, and the distinction matters to the reader: a segment where you can say two workloads exchanged bytes is in a different position from one where nothing at all would exist. ## Making the claim survive contact Three failure modes kill coverage statements: **Percentages measured in bytes.** "We inspect 80% of east-west traffic" can be true while 90% of segments are dark, because one replication segment is most of the bytes. Always express coverage as a count of segments and name them. **Silent decay.** Teams create segments and node pools without asking security. The list is only true if it is reconciled against the platform's own inventory on a schedule, with a standing rule that **anything new is unsensed until proven otherwise**. Without that rule, the document ages into a false statement, which is worse than no statement. **Unstable placement.** Because the scheduler moves workloads, a claim about a service is not durable. Claims must be anchored to nodes and segments, which change slowly, not to service pairs, which do not. ## Who signs This is the part that separates a principal answer from a senior one. The security function produces a **fact** — these segments have no sensing, and here is what that means for evidence after an intrusion. It does not have the authority to accept the consequence. The accountable owner of the business capability running in those segments signs the residual, dated, with a review point. That does three things: it puts the cost where the decision is, it converts "security says we need more sensors" into a funding conversation with a named counterparty, and it means the answer to an auditor is "yes, and here is who accepted it" rather than an argument about whether the gap was known. When an owner refuses both the sensor and the residual, the remaining lever is to make the unsensed segment matter less — reduce what runs there, or reduce what it can reach — which is a different budget and a different team, and it is a legitimate outcome to propose. ## What to say out loud in the interview Commit to the uncomfortable sentence: for the four segments in five with no sensor, an intruder whose entire path stayed inside one of them would leave **no network record at all**, and the first indication would come from somewhere else or from someone else. Saying that plainly, with a dated list and a signature behind it, is a stronger position than any claim of near-complete coverage — because the near-complete claim will not survive the first question about same-node traffic.