Skip Navigation

Ask an Expert: Building a More Proactive Security Program

Oct 07, 2026

Security teams often have access to more information than they can effectively use. And in the GSOC environment, the question becomes how can they better utilize that information to strengthen their situational awareness, shifting from a reactive state to one that can proactively anticipate threats?

For the first installment of our Ask an Expert series, Zach Henderson, Director of Managed Services, shares his perspective:

"Most organizations we work with do not have an information problem, they have a signal problem. Meaning that adding another feed rarely makes a GSOC smarter but has a high potential of raising the noise level until operators stop trusting the alarms in front of them. In my experience, there are three things that move a program from reactive to proactive:

First, clean your data. Stale cardholder records, doors that generate hundreds of alarms each day, and misaligned camera views can make it difficult to identify what matters. No correlation engine can overcome a poor data baseline. Cleaning that data may not be the most exciting work, but it makes everything downstream possible.

Second, work backward from decisions, not forward from data. The question should not be, “What can we collect?” It should be, “What decision do we need to make faster, and what information would help us make it sooner?” Organizations should understand the problem first and then identify the right platforms and data to support it.

Last, separate operators from analysts. Operators are focused on responding to incidents vs. an analyst should look for patterns that are more likely to surface when actively reviewing past activity. A weekly trend review can turn “this door has failed nine times in six weeks” into a work order to fix the root cause instead of a tenth response.

Technology is often the easiest part to purchase and the hardest part to operationalize. Getting ahead of events requires written playbooks, trained operators, regular trend reviews, and leadership willing to measure leading indicators rather than only counting incidents closed.

If every metric is a lagging one, an organization is only measuring how well it reacts. But if you start tracking metrics, such as the alarm to actionable ratio and repeat location counts, those numbers begin to tell a story and, as a result, the organization can start looking ahead."