Home / Sample workflows

Four views of one workflow

Where Security Work Waits

Every workflow here is shown four ways — a heat map of where time concentrates, a time scale of work versus waiting, the exposure it creates, and the improvement lever most likely to recover capacity. Illustrative, benchmark-based; run the method on your own data for real numbers.

Flagship example · alert-to-detection-rule

One detection rule, end to end

1 · Heat map — where time concentrates

2 min

Alert ingested

5 min

Automated enrichment

14 days

Queue for analyst

3 hrs

Manual triage

6 days

Escalation handoff

20 min

Rule deployed

■ flowing well■ worth watching■ time lostThe fast steps are already fast — automating them changes nothing.

2 · Time scale — work vs waiting, drawn to scale

all 3.5 hrs of real work — <1% of the timeline

QUEUE FOR ANALYST · 14 DAYS

ESCALATION · 6 DAYS

3.5 hrs

active work · <1% of cycle

20 days

waiting in queues & handoffs

≈0.7%

process cycle efficiency

3 · Exposure — varies by process

Security

Detection logic reaches production late; the gap stays open longer.

Operational

Analyst capacity is consumed by the queue, not the work.

Financial

Cost of delay accrues across the 20-day cycle.

Customer

—

4 · Improvement levers — how the capacity comes back

Reduce Waiting

Greatest opportunity here

Clarify queue ownership
Limit work in progress
Cut the escalation handoff delay

Reduce Rework

Minor secondary lever

Improve alert context up front
Reduce triage rejections

Eliminate Unnecessary Work

Flag non-value-add steps to quantify

Remove redundant approvals
Standardize repeatable steps

The 20 days of queue and handoff is the recoverable target — not the 3.5 hours of work. Quantify the recovery in the Investment & Return Calculator →

The pattern across eleven workflows

Same four views, every workflow

Different work, same shape: active work is a small fraction of elapsed time, and the queue is where the exposure and the recovery both live.

Patch deployment routine cycle

0.4%PCE

Heat map · where time concentrates

1.2d

Time scale · work vs waiting

2.0h active · 21 days waiting

Exposure · varies by process

SecurityUnpatched exposure window

OperationalCapacity tied up in scheduling

Financial—

Customer—

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Access provisioning joiner

0.5%PCE

Heat map · where time concentrates

12h q

1.3d

16h q

7h q

Time scale · work vs waiting

30m active · 4 days waiting

Exposure · varies by process

Security—

OperationalOnboarding delay

FinancialLost working time

CustomerNew-hire productivity

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Access deprovisioning leaver

0.7%PCE

Heat map · where time concentrates

11h q

21h q

11h q

10h q

Time scale · work vs waiting

30m active · 3 days waiting

Exposure · varies by process

SecurityLingering access after exit

OperationalManual offboarding load

Financial—

Customer—

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Security change approval

0.6%PCE

Heat map · where time concentrates

16h q

1.0d

14h q

Time scale · work vs waiting

1.0h active · 7 days waiting

Exposure · varies by process

SecuritySlow control changes

OperationalChange backlog

Financial—

CustomerDelivery delay

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Vendor / third-party risk review

1.3%PCE

Heat map · where time concentrates

1.2d

10d

Time scale · work vs waiting

8.0h active · 25 days waiting

Exposure · varies by process

SecurityUnassessed third-party risk

OperationalReview backlog

FinancialProcurement delay

CustomerBusiness onboarding delay

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Vulnerability remediation critical

1.4%PCE

Heat map · where time concentrates

2h q

1.9d

Time scale · work vs waiting

3.0h active · 9 days waiting

Exposure · varies by process

SecurityOpen exploit window

OperationalRemediation backlog

FinancialCompliance exposure

Customer—

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Alert triage one alert

1.4%PCE

Heat map · where time concentrates

5h q

10h q

8h q

6h q

Time scale · work vs waiting

24m active · 1.2 days waiting

Exposure · varies by process

SecuritySlow / missed detection

OperationalAnalyst capacity drain

Financial—

Customer—

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Phishing report triage

2.8%PCE

Heat map · where time concentrates

3h q

4h q

2h q

Time scale · work vs waiting

24m active · 0.6 days waiting

Exposure · varies by process

SecurityUser-reported threat dwell

OperationalQueue of reports

Financial—

Customer—

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Incident response detect to contain

2.3%PCE

Heat map · where time concentrates

36d

29d

Time scale · work vs waiting

60h active · 107 days waiting

Exposure · varies by process

SecurityExtended containment window

OperationalTeam fully consumed

FinancialCost of delay

CustomerStakeholder frustration

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Threat hunting one mission

5.7%PCE

Heat map · where time concentrates

1.1d

Time scale · work vs waiting

20h active · 14 days waiting

Exposure · varies by process

SecurityUndetected threats persist

OperationalCapacity for proactive work

Financial—

Customer—

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Detection engineering one rule

11.2%PCE

Heat map · where time concentrates

10h q

1.6d

1.1d

24h q

Time scale · work vs waiting

19h active · 6 days waiting

Exposure · varies by process

SecurityDetections reach prod late

OperationalReduced analyst productivity

Financial—

Customer—

Primary improvement lever

Reduce Waitingqueue & handoff is the dominant cost

Open in the worksheet →

Heat-map colour and PCE are computed from the benchmarked sample data (linear PCE = work ÷ work + queue). Exposure categories are process-dependent. The primary lever is an estimate — the Investment & Return Calculator quantifies it from your own numbers. See how the pattern collapses PCE →