The only doctor in the building
A good security review is like a good appointment. An expert looks at one system, asks careful questions, and leaves it healthier.
Now picture one doctor responsible for a whole city. Every patient who is seen gets good care, and almost nobody is seen.
That is the position of a central security team in a decentralized organization: a few hundred systems reviewed properly, in a population of thousands. Working harder doesn't close the gap, and neither does hiring. The population is too large for a model built on appointments.
What public health does differently
Public health does not try to see every patient. It works on the population.
- It makes common protections universal. Clean water protects people who never think about it.
- It makes self-care possible. Most people handle routine problems with clear guidance and what is on the pharmacy shelf.
- It watches the whole population. Surveillance shows where illness is clustering before any one clinic would notice.
- It saves specialists for the cases that need them.
Each of these has a counterpart in cybersecurity.
Three levels of care
Federated Cybersecurity (FC) organizes the same shift as three levels of care.
- Self-care. Resource teams do the routine work themselves, with guidance built into the process. In Federated Cyber Risk (FCR), that means a team assessing its own risk and building its own security plan. Most resources start here, and many can stay here.
- Guided care. When something needs attention, a flag or an indicator directs targeted help to that team.
- Specialist care. The security team's expert time goes to the serious cases, where judgment and experience change the outcome.
Underneath all three sit the common protections: shared services that are verified once and relied on by every team that uses them.
Each methodology in the family carries part of this. FCR is the self-care path. Federated Practice Monitoring is the surveillance, showing where guided and specialist care should go. The specialists are the security team.
The security team's new job
The security team does not do less in this model. It does different work.
It designs the self-care path, so that a team with no security training can do the work well. It verifies the common protections that every plan inherits. And it reads the population data: which teams are covered, where gaps cluster, which indicators are moving.
It still sees patients. It chooses which ones, based on what the population data shows.
What changes at scale
Two things change when a security team moves from appointments to population health.
The first is coverage. The team can see the whole population, including the part that was never reviewed. Seeing that gap for the first time is uncomfortable, and it is also the first accurate picture of the organization's risk.
The second is leverage. The number of resources covered can grow from hundreds to thousands without the team growing in step, because most of the work happens with the people who own the resources.
Where this model fits
The public health model is most useful when three things are true:
- You are responsible for security across many more systems than you can review.
- Most of those systems are run by people who don't report to you.
- You need a view of the whole population, and you only have one of the systems you've seen.
None of this retires the appointment. An expert review is still the right care for a serious case. Population health is what gets the expert's time to those cases, and keeps everyone else covered in the meantime.
The model depends on people outside the security team taking part. The Five Principles of Participation describes what that takes.