Most of our signals are currently binary trusted (workload-enabled, posture-evaluation-succeeded) or entirely untrusted/suspended (workload-disabled, workload-compromised, credential-revoked).
However modern systems require more granular, often risk based, signals. To maintain business continuity during an active threat or compliance drift, organizations increasingly rely on "adaptive resilience". To gracefully degrade a workload's privileges (e.g., revoking database write access or enforcing network quarantine) rather than executing a catastrophic shutdown.
I propose we add a new WISE event type: workload-degraded. This signals that a workload's trust level has been intentionally reduced, but the workload itself has not been completely suspended or purged. We can optionally capture why the degradation occurred (e.g., anomaly detected, policy drift, missing provenance), and the extent of the degradation (e.g., network isolation, read-only mode).
Most of our signals are currently binary trusted (workload-enabled, posture-evaluation-succeeded) or entirely untrusted/suspended (workload-disabled, workload-compromised, credential-revoked).
However modern systems require more granular, often risk based, signals. To maintain business continuity during an active threat or compliance drift, organizations increasingly rely on "adaptive resilience". To gracefully degrade a workload's privileges (e.g., revoking database write access or enforcing network quarantine) rather than executing a catastrophic shutdown.
I propose we add a new WISE event type:
workload-degraded. This signals that a workload's trust level has been intentionally reduced, but the workload itself has not been completely suspended or purged. We can optionally capture why the degradation occurred (e.g., anomaly detected, policy drift, missing provenance), and the extent of the degradation (e.g., network isolation, read-only mode).