A detection-engineering team has a year to reach risk-based alerting. They need sixty analytics that meet a real bar; they produce about one a week on the good weeks. Nothing is wrong with the engineers.
You are going to load the same eleven-step process at four maturity levels in PFV-EZ, diagnose what is holding each one back, and watch the waiting disappear. No guessing about your own numbers — the samples are already built. Bring your own process afterwards.
Level two is not chaos. There is a backlog, a repeatable-ish way of working, and two engineers who are genuinely good. Things get done when someone pushes.
But prioritisation is whoever asks loudest, "done" means something slightly different to each engineer, coverage is reported as nine hundred rules — which is inventory, not coverage — and when you ask how long an analytic takes, the answer is "depends." That is the level-two answer to every question.
Eleven steps, from an intel note to a tuned analytic in production with a measured false-positive rate. Open it, press See my exposure, and read the three numbers.
Twenty-two hours of work inside seventy-eight business days. One percent of the elapsed time is somebody building a detection. Typical for creative work is about five percent; world-class is twenty-five. This team is not broken and not lazy — they are below average, and nobody knew, because nobody had put the two numbers side by side.
A one-page definition of done: mapped to a technique, risk score and confidence, data model validated with evidence attached, test cases, a tuning plan, a named owner for the 30-day FP review. It is the same bar risk-based alerting needs — promoted from "extra work for the pilot" to "how we work."
A single intake with a two-line priority rule anyone can apply without a meeting. A WIP limit of three per engineer, which was the least popular decision of the quarter and the one that mattered most. And a conversation with the platform team that produced a self-service data catalogue: source, normalisation, coverage, last verified. Twenty-one days became twenty minutes.
Run Level 2 and Level 3 side by side and read the recommendation cards, not just the headline:
Same eleven steps. Compare the heat map to what you just saw.
Four numbers on the wall, refreshed monthly from the same eleven steps: lead time with its spread, PCE per step, rework rate as a first-class metric rather than an embarrassment, and coverage as the percentage of prioritised techniques with a validated analytic in production — never again as a rule count.
A standard pre-approved change class. Tuning against a measured false-positive baseline instead of instinct. A shared attack-data harness.
Level five is not "very good at level four." It is when improvement stops needing a champion because the machinery generates it.
Defect prevention: every bounced analytic triggers a five-minute why, and the answer is written into the definition of done. Production telemetry feeding the line: any analytic crossing an FP threshold opens its own tuning ticket — the process consumes its own output. Retirement as a real step: with FP rates and true-positive counts per analytic, they retired 140 noisy or redundant detections in a quarter and the SOC's alert volume fell 11% before risk-based alerting shipped anything.
The samples ship as the mapped line — the path an analytic takes when nothing goes wrong. Four in ten did go wrong at level 2. Load Level 2 again and model it: