Your segmentation diagram backs a customer contract, but an intruder would meet no filter on the real path - what do you do, and who signs for it?

## Why this is a judgment question and not an engineering one Everything technical here is already decided: the traffic bypasses the boundary, enforcement has to move, and moving it takes a programme of change nights. What makes it a principal-level question is that three different clocks start at once and they belong to three different people. 1. **The exposure clock.** An intruder on either side has an unfiltered path today. 2. **The assertion clock.** Your organisation has told a customer - in a contract, a security questionnaire, an attestation, an architecture appendix - that this separation exists. You now know that statement is false. Continuing to make it, or to renew it, with knowledge is a materially different thing from having been wrong. 3. **The funding clock.** The fix consumes engineering time, maintenance windows and possibly re-addressing work, none of which has a budget line yet. Most failures here are a category error: treating (2) and (3) as consequences of (1) that the network team can manage privately. ## The assertion is not yours to sit on The instinct - fix it quietly, tell nobody, avoid alarm - is understandable and is the wrong call, for a reason that is not moralistic. Contracts commonly contain notification obligations triggered by known control failures, and questionnaires and attestations are renewed on a cycle. If the next renewal is signed while you personally know the control is not in place, the organisation has made a knowing misstatement, and the person who knew and did not escalate is the person the record will name. So the escalation is: evidence of the gap, scope of what it affects, what has been done immediately, and the plan with dates - handed to whoever owns customer commitments, with legal and compliance in the room. Let them decide disclosure. Your job is to make sure the decision is made by people with the authority to make it, and that the decision is recorded. The two disqualifying moves are worth naming because both get proposed in real rooms. Redrawing the diagram to match reality and closing the finding as "documentation corrected" removes no reachability at all. Re-scoping the attested boundary so the bypass falls outside the described environment turns an operational gap into a description that is now shaped to avoid the truth. Both should be argued down explicitly. ## Buy what is cheap now A dated plan is not a control. Between the finding and the cut-over there is usually something that needs no maintenance window and no business sign-off: denying the specific offending pair at whichever enforcement surface is already on that path, tightening what is reachable at the endpoints, or - at minimum - instrumenting the bypass path so that use of it is at least observed. State honestly what each of these does and does not cover, because a compensating control described as equivalent is how a real gap disappears from a risk register. ## Who can refuse, and what that means for the plan This is the part junior plans always miss. The network team does not own the outage. Each maintenance night carries risk to an application, and the person entitled to accept or refuse that risk is that application's business owner. A remediation plan that assumes forty windows will be granted because security asked is not a plan; it is a wish. The credible version names, per zone pair: the owner, the proposed window, the flows at risk, and the rollback. Where an owner refuses, that refusal is itself a decision that belongs on the risk register with a name against it - which is usually what finally releases the budget, because an accepted risk with an owner behaves very differently in a governance forum than an engineering complaint. Budget for the unglamorous parts too: the discovery effort, the flow-to-owner mapping, and the cleanup change that removes the bypass path. Programmes that stop before cleanup have bought a slide, not containment. ## What you report, and in what units Report containment in units an intruder would recognise: zone pairs whose traffic now transits an enforcing device with policy active, exceptions still live and their expiry dates, and the paths still unfiltered. Do not report project completion; a programme can be eighty per cent complete with the exact pair that matters untouched. ## The answer that lands in an interview Name the three clocks, put the disclosure decision with legal and commercial rather than with yourself, buy immediate partial mitigation without overstating it, and present a plan whose windows have named owners who are allowed to say no. Then say plainly what the interviewer is listening for: until enforcement is on the path, the contract describes a control the customer does not have.