{"id":11669,"date":"2026-10-31T07:30:00","date_gmt":"2026-10-31T07:30:00","guid":{"rendered":"https:\/\/www.cotocus.com\/blog\/?p=11669"},"modified":"2026-10-31T07:30:00","modified_gmt":"2026-10-31T07:30:00","slug":"secops-eight-anti-patterns-listicle","status":"publish","type":"post","link":"https:\/\/www.cotocus.com\/blog\/secops-eight-anti-patterns-listicle\/","title":{"rendered":"Eight Ways Good Intentions Wreck a SecOps Agreement"},"content":{"rendered":"

Nobody sabotages a SecOps agreement on purpose. It dies of well-meaning habits \u2014 small compromises, each defensible in the meeting where it was made, that together hollow the thing out. The list below collects eight of those habits in the wild. If you recognise your own team in three or more of them, the agreement probably exists on paper only; the good news is that every one of these is reversible, and most reversals cost nothing but an uncomfortable conversation. Read it as a field guide to the ways these arrangements die quietly \u2014 and, at the end, to the order in which to revive them.<\/p>\n

The SecOps report thrown over the wall<\/h2>\n

The oldest failure in the book, and still the most common: a scanner finishes, a spreadsheet with thousands of rows lands in a shared channel, and the sender considers the job done. A report is not a delivery. Until each finding has a named receiving team and a date, the wall has simply moved from inside the security department to the edge of it, and the findings pile up on the landing side exactly as they did before.<\/p>\n

“The SOC will catch it”<\/h2>\n

Detection is not hardening. When operations skips a baseline fix because the monitoring team has “eyes on it”, the estate quietly carries a preventable weakness and a 24-hour room inherits the consequence. The SOC exists to catch what slips through; it is not a warehouse for things that were never fixed. Agreements that survive write the division explicitly: the watchers watch, the builders build, and neither borrows the other’s excuse.<\/p>\n

Security tools that skip the change board<\/h2>\n

Scanners run with root. Endpoint agents run as SYSTEM. Automation platforms hold tokens that can trigger actions across the estate. These are not ordinary tools; they are trust boundaries wearing software costumes, and the agreement should say so in those words. A sensible rule: treat each of them the way you treat domain admin access.<\/p>\n