The capability list is the same for everyone. What changes is which part of it decides whether the week went well — so each of these pages starts from the situation the role is actually in, and ends with what to turn on first.
startup · 5–50 engineers · no security hire
You ship every week, there is nobody whose job is security, and one leaked deploy key or one poisoned dependency is a bad quarter.
One stack in your own cloud covers cloud, code, identity and CI/CD, with defaults that stay quiet until a chain actually forms. You get a security function before you can afford to hire one.
8 services · 2 vCPU · $0 in production · Elastic License 2.0
CTO / VP engineering · accountable for shipping
Security work arrives as a ticket queue in someone else's tool, slows the team down, and you cannot say precisely what data leaves your environment.
Findings arrive where the code is — as check runs and pull requests in the forge the team already uses — and correlation runs before the merge rather than after the incident review.
GitHub · GitLab · CircleCI · Jenkins feedback · read-only cloud roles · 0 bytes egress
CISO / head of security · accountable to the board
You are asked for coverage numbers and risk in business terms, you have to show your working, and the backlog is a list of forty thousand configuration findings nobody will ever fix.
Risk arrives as ranked chains with the score, the rule and every contributing signal attached. Coverage is a set of numbers with the command that counts them, so you can re-derive a slide a year later.
609 detections · 75 correlation rules · 96 ATT&CK techniques · 7 framework evidence engines
platform / SRE · owns the build and the cloud
You own the pipelines, the base images, the certificates and the IAM roles — and you find out a pipeline was tampered with from a post-incident write-up.
The build system is treated as an untrusted environment: workflow tampering, unpinned actions, provenance gaps, release freshness and certificate lifecycle are all first-class signals with direct evidence.
4 CI/CD providers · 34 tier-1 rules · provenance and release-freshness gates
SOC / detection engineering · owns the queue
The queue is configuration noise at the top and real chains buried in it, and every alert you escalate requires re-deriving the context from three dashboards by hand.
Detections arrive with the reasoning attached, correlation reduces many signals into one incident, and every risk links to the exact signals, rules and raw events that produced it.
166 typed signal types · 75 correlation rules · evidence trail per risk
regulated · data residency, audit and attestation
Your regulator, your customer contracts or your own policy say telemetry cannot leave your jurisdiction, and you still have to show that a specific control operated on a specific date.
The whole platform runs inside your boundary, including the datastores and the artefacts, with no outbound calls and evidence generated from live findings rather than gathered by hand.
air-gap capable · BYO KMS · per-tenant hash-chained audit log · 7 framework evidence engines
If none of these is you — an MSSP running this for several clients, or a security team of forty with an existing SIEM — the honest answer is that the platform is built for the first case and used beside, not instead of, the second. The comparison pages say where it fits and where it does not.