The watch keep desk, strake by strake

The perimeter drill desk begins with a drawn plan of your estate at the network edge. We list every service that accepts traffic from outside a trusted zone, every account that can cross that boundary, and every route that allows the crossing to happen. The drill itself is a scripted exercise run against a written scenario, not a scan or a scanner output. It asks the human questions first: who is allowed to call this endpoint, what happens if the certificate chain changes beneath it, and which route withdrawal would break a partner integration.

Drills are run with your own engineers present so that knowledge stays inside the wall after we leave. Each drill closes with a short findings table covering what held, what flexed, and what needs a change request before the next drill. We keep the findings blunt and short. A perimeter that is documented only in a vendor portal is not a perimeter at all.

A shield drill week takes one defensive control and pushes it until it holds under pressure or is honestly marked as thin. Weeks are scheduled a quarter ahead so the client team can reserve the calendar and prepare the environment. Typical subjects include identity federation, secret rotation, backup restores, egress filtering and recovery of a simulated compromised host. We do not run exercises that would disturb production without a written plan and a rollback route agreed with your team.

Each week ends with a one-page statement: what the shield now covers, what evidence proves it, and what remains open. The statement is written in plain English so that leadership can read it without an interpreter. When a week exposes a control that cannot be made to hold in the agreed time, we say so directly rather than reframing it as an opportunity for a follow-on engagement.

Roster log sessions are held with the people who actually hold the pager. Together we write the on-call schedule, the escalation ladder and the coverage map in a form the team will genuinely use, including the awkward weeks around holidays and handovers. Every candidate is interviewed individually about their availability, their comfort with the systems they will be paged for, and the routes they would follow at three in the morning.

The session output is a working roster plus a short set of failure modes: single points of coverage, knowledge gaps, and any role that has become a permanent assumption. The roster is published weekly and every relief is recorded in a watch book so that ownership stays visible. We treat a roster that only exists in a chat channel as a defect rather than a convenience.

A watch audit day reads the records rather than the dashboards. We examine the last quarter of handover notes, incident write-ups, change tickets and drill reports, then compare them against what the systems actually did according to their own logs. Where the book and the wall disagree, we note the exact line and the exact timestamp.

The audit day produces a short report organised around three questions: was the watch staffed as promised, was the work recorded as performed, and did any silence hide a decision that should have been written down. Recommendations are limited to actions that fit inside the next relief cycle. An audit that ends in a hundred-page appendix nobody reads is a failure of the desk, not a sign of thoroughness.

Signal relay hours trace how a single alert travels from the system that raises it to the person who reads it. We follow the full path through agents, brokers, rules, webhooks and notification services, noting every transformation, every delay and every point where the signal can be swallowed silently. Thresholds inherited from an older age and routes that no longer match the estate are marked for removal.

The finished map is a plain document that any engineer can follow without access to our tools. It names each hop, the owner of that hop and the expected latency. Clients keep the map and can update it as the estate changes. We can also run a periodic relay review if the estate changes often, but the map itself is never held back as leverage.

Relief handover evenings rehearse the change of watch. Outgoing and incoming staff walk the open items, the fragile services and the scheduled work together against a written handover form. We run the evening twice: once as a rehearsal with no consequences and once with a controlled disturbance so that the incoming watch must exercise the record, not just read it.

A handover that cannot be written in plain English is treated as a defect in the roster itself, and we help rewrite it before the next relief. The evening closes with a signed handover note and a short list of items the incoming watch has accepted. Every relief is written into the watch book, which means the question of who held the watch has a written answer.