[{"data":1,"prerenderedAt":841},["ShallowReactive",2],{"navigation_docs":3,"-design-design-thinking":369,"-design-design-thinking-surround":836},[4,8,72,102,220,266,280,301,365],{"title":5,"path":6,"stem":7},"Introduction","\u002Fintroduction","0.introduction",{"title":9,"icon":10,"path":11,"stem":12,"children":13,"page":67},"Company","i-lucide-building-2","\u002Fcompany","1.company",[14,18,22,26,30,34,38,42,46,50,54,68],{"title":15,"path":16,"stem":17},"About","\u002Fcompany\u002Fabout","1.company\u002F0.about",{"title":19,"path":20,"stem":21},"Values","\u002Fcompany\u002Fvalues","1.company\u002F1.values",{"title":23,"path":24,"stem":25},"Communication","\u002Fcompany\u002Fcommunication","1.company\u002Fcommunication",{"title":27,"path":28,"stem":29},"Competition","\u002Fcompany\u002Fcompetition","1.company\u002Fcompetition",{"title":31,"path":32,"stem":33},"Hybrid Working","\u002Fcompany\u002Fhybrid-working","1.company\u002Fhybrid-working",{"title":35,"path":36,"stem":37},"Manchester Office","\u002Fcompany\u002Foffice","1.company\u002Foffice",{"title":39,"path":40,"stem":41},"Operations","\u002Fcompany\u002Foperations","1.company\u002Foperations",{"title":43,"path":44,"stem":45},"Policies","\u002Fcompany\u002Fpolicies","1.company\u002Fpolicies",{"title":47,"path":48,"stem":49},"Problem Statement","\u002Fcompany\u002Fproblem-statement","1.company\u002Fproblem-statement",{"title":51,"path":52,"stem":53},"Product Strategy","\u002Fcompany\u002Fproduct-strategy","1.company\u002Fproduct-strategy",{"title":55,"path":56,"stem":57,"children":58,"page":67},"Products","\u002Fcompany\u002Fproducts","1.company\u002Fproducts",[59,63],{"title":60,"path":61,"stem":62},"Capability Exchange","\u002Fcompany\u002Fproducts\u002Fcapability-exchange","1.company\u002Fproducts\u002Fcapability-exchange",{"title":64,"path":65,"stem":66},"ESProfiler Platform","\u002Fcompany\u002Fproducts\u002Fesprofiler","1.company\u002Fproducts\u002Fesprofiler",false,{"title":69,"path":70,"stem":71},"Security","\u002Fcompany\u002Fsecurity","1.company\u002Fsecurity",{"title":73,"icon":74,"path":75,"stem":76,"children":77,"page":67},"People Ops","i-lucide-users","\u002Fpeople-ops","2.people-ops",[78,82,86,90,94,98],{"title":79,"path":80,"stem":81},"Compensation","\u002Fpeople-ops\u002Fcompensation","2.people-ops\u002Fcompensation",{"title":83,"path":84,"stem":85},"Education","\u002Fpeople-ops\u002Feducation","2.people-ops\u002Feducation",{"title":87,"path":88,"stem":89},"Expenses","\u002Fpeople-ops\u002Fexpenses","2.people-ops\u002Fexpenses",{"title":91,"path":92,"stem":93},"Holiday & Leave","\u002Fpeople-ops\u002Fleave","2.people-ops\u002Fleave",{"title":95,"path":96,"stem":97},"Onboarding","\u002Fpeople-ops\u002Fonboarding","2.people-ops\u002Fonboarding",{"title":99,"path":100,"stem":101},"Recruitment","\u002Fpeople-ops\u002Frecruitment","2.people-ops\u002Frecruitment",{"title":103,"icon":104,"path":105,"stem":106,"children":107,"page":67},"Engineering","i-lucide-rocket","\u002Fengineering","3.engineering",[108,151,155,175,196,200,208,212,216],{"title":109,"path":110,"stem":111,"children":112,"page":67},"Contributing","\u002Fengineering\u002Fcontributing","3.engineering\u002Fcontributing",[113,117,121,125,129,142],{"title":114,"path":115,"stem":116},"Development Setup","\u002Fengineering\u002Fcontributing\u002Fdevelopment-setup","3.engineering\u002Fcontributing\u002F1.development-setup",{"title":118,"path":119,"stem":120},"Engineering Operations","\u002Fengineering\u002Fcontributing\u002Fengineering-operations","3.engineering\u002Fcontributing\u002F2.engineering-operations",{"title":122,"path":123,"stem":124},"Documentation","\u002Fengineering\u002Fcontributing\u002Fdocumentation","3.engineering\u002Fcontributing\u002F3.documentation",{"title":126,"path":127,"stem":128},"Agentic Coding","\u002Fengineering\u002Fcontributing\u002Fagentic-coding","3.engineering\u002Fcontributing\u002Fagentic-coding",{"title":130,"path":131,"stem":132,"children":133,"page":67},"Back End","\u002Fengineering\u002Fcontributing\u002Fback-end","3.engineering\u002Fcontributing\u002Fback-end",[134,138],{"title":135,"path":136,"stem":137},"API Guidelines","\u002Fengineering\u002Fcontributing\u002Fback-end\u002Fapi-guidelines","3.engineering\u002Fcontributing\u002Fback-end\u002Fapi-guidelines",{"title":139,"path":140,"stem":141},"LLM Prompts & Langfuse Integration","\u002Fengineering\u002Fcontributing\u002Fback-end\u002Fllm-prompts","3.engineering\u002Fcontributing\u002Fback-end\u002Fllm-prompts",{"title":143,"path":144,"stem":145,"children":146,"page":67},"Front End","\u002Fengineering\u002Fcontributing\u002Ffront-end","3.engineering\u002Fcontributing\u002Ffront-end",[147],{"title":148,"path":149,"stem":150},"Testing","\u002Fengineering\u002Fcontributing\u002Ffront-end\u002Ftesting","3.engineering\u002Fcontributing\u002Ffront-end\u002Ftesting",{"title":152,"path":153,"stem":154},"Production Database","\u002Fengineering\u002Fdatabase-connection","3.engineering\u002Fdatabase-connection",{"title":156,"path":157,"stem":158,"children":159},"Deployment","\u002Fengineering\u002Fdeployment","3.engineering\u002Fdeployment",[160,163,167,171],{"title":60,"path":161,"stem":162},"\u002Fengineering\u002Fdeployment\u002Fcapability-exchange","3.engineering\u002Fdeployment\u002Fcapability-exchange",{"title":164,"path":165,"stem":166},"Langfuse Deployment","\u002Fengineering\u002Fdeployment\u002Fecs-langfuse-deployment","3.engineering\u002Fdeployment\u002Fecs-langfuse-deployment",{"title":168,"path":169,"stem":170},"ESP Platform Configuration","\u002Fengineering\u002Fdeployment\u002Fesp-platform-configuration","3.engineering\u002Fdeployment\u002Fesp-platform-configuration",{"title":172,"path":173,"stem":174},"Platform","\u002Fengineering\u002Fdeployment\u002Fplatform","3.engineering\u002Fdeployment\u002Fplatform",{"title":176,"path":177,"stem":178,"children":179,"page":67},"Github","\u002Fengineering\u002Fgithub","3.engineering\u002Fgithub",[180,184,188,192],{"title":181,"path":182,"stem":183},"Packages","\u002Fengineering\u002Fgithub\u002Fpackages","3.engineering\u002Fgithub\u002Fpackages",{"title":185,"path":186,"stem":187},"Personal Access Token","\u002Fengineering\u002Fgithub\u002Fpersonal-access-token","3.engineering\u002Fgithub\u002Fpersonal-access-token",{"title":189,"path":190,"stem":191},"Troubleshooting","\u002Fengineering\u002Fgithub\u002Ftroubleshooting","3.engineering\u002Fgithub\u002Ftroubleshooting",{"title":193,"path":194,"stem":195},"Workflows","\u002Fengineering\u002Fgithub\u002Fworkflows","3.engineering\u002Fgithub\u002Fworkflows",{"title":197,"path":198,"stem":199},"Platform Ops","\u002Fengineering\u002Fplatform-ops","3.engineering\u002Fplatform-ops",{"title":172,"path":201,"stem":202,"children":203,"page":67},"\u002Fengineering\u002Fplatform","3.engineering\u002Fplatform",[204],{"title":205,"path":206,"stem":207},"useAPI","\u002Fengineering\u002Fplatform\u002Fuse-api","3.engineering\u002Fplatform\u002Fuse-api",{"title":209,"path":210,"stem":211},"Project Management","\u002Fengineering\u002Fproject-management","3.engineering\u002Fproject-management",{"title":213,"path":214,"stem":215},"Releases","\u002Fengineering\u002Frelease","3.engineering\u002Frelease",{"title":217,"path":218,"stem":219},"Tools","\u002Fengineering\u002Ftools","3.engineering\u002Ftools",{"title":221,"icon":222,"path":223,"stem":224,"children":225,"page":67},"Design","i-lucide-palette","\u002Fdesign","4.design",[226,247,251,255,259,262],{"title":227,"path":228,"stem":229,"children":230,"page":67},"Personas","\u002Fdesign\u002Fpersonas","4.design\u002F0.personas",[231,235,239,243],{"title":232,"path":233,"stem":234},"CISO - Simon","\u002Fdesign\u002Fpersonas\u002F01-ciso-simon","4.design\u002F0.personas\u002F01-ciso-simon",{"title":236,"path":237,"stem":238},"Head of Cyber - Harry","\u002Fdesign\u002Fpersonas\u002F02-head-of-cyber-harry","4.design\u002F0.personas\u002F02-head-of-cyber-harry",{"title":240,"path":241,"stem":242},"Security Architect - Sasha","\u002Fdesign\u002Fpersonas\u002F03-security-architect-sasha","4.design\u002F0.personas\u002F03-security-architect-sasha",{"title":244,"path":245,"stem":246},"Procurement Officer - Paige","\u002Fdesign\u002Fpersonas\u002F04-procurement-officer-paige","4.design\u002F0.personas\u002F04-procurement-officer-paige",{"title":248,"path":249,"stem":250},"Design Thinking","\u002Fdesign\u002Fdesign-thinking","4.design\u002F1.design-thinking",{"title":252,"path":253,"stem":254},"Design & Development","\u002Fdesign\u002Fdesign-and-development","4.design\u002F3.design-and-development",{"title":256,"path":257,"stem":258},"Branding","\u002Fdesign\u002Fbranding","4.design\u002F4.branding",{"title":217,"path":260,"stem":261},"\u002Fdesign\u002Ftools","4.design\u002F5.tools",{"title":263,"path":264,"stem":265},"Customer Success","\u002Fdesign\u002Fworking-with-customers","4.design\u002F6.working-with-customers",{"title":267,"icon":268,"path":269,"stem":270,"children":271,"page":67},"Sales","i-lucide-dollar-sign","\u002Fsales","4.sales",[272,276],{"title":273,"path":274,"stem":275},"Customer Onboarding","\u002Fsales\u002Fonboarding","4.sales\u002Fonboarding",{"title":277,"path":278,"stem":279},"Sales Tools","\u002Fsales\u002Ftools","4.sales\u002Ftools",{"title":281,"icon":282,"path":283,"stem":284,"children":285,"page":67},"Marketing","i-lucide-book-image","\u002Fmarketing","5.marketing",[286,290,294,297],{"title":287,"path":288,"stem":289},"Content","\u002Fmarketing\u002Fcontent","5.marketing\u002Fcontent",{"title":291,"path":292,"stem":293},"Messaging","\u002Fmarketing\u002Fmessaging","5.marketing\u002Fmessaging",{"title":217,"path":295,"stem":296},"\u002Fmarketing\u002Ftools","5.marketing\u002Ftools",{"title":298,"path":299,"stem":300},"Website","\u002Fmarketing\u002Fwebsite","5.marketing\u002Fwebsite",{"title":302,"icon":303,"path":304,"stem":305,"children":306,"page":67},"AI & Data Ops","i-lucide-database","\u002Fdata-ops","6.data-ops",[307,315,319,344,361],{"title":60,"path":308,"stem":309,"children":310,"page":67},"\u002Fdata-ops\u002Fcapability-exchange","6.data-ops\u002FCapability Exchange",[311],{"title":312,"path":313,"stem":314},"Leaderboard Calculation","\u002Fdata-ops\u002Fcapability-exchange\u002Fleaderboard-calculation","6.data-ops\u002FCapability Exchange\u002Fleaderboard-calculation",{"title":316,"path":317,"stem":318},"Account Portal (CAS)","\u002Fdata-ops\u002Faccount-portal","6.data-ops\u002Faccount-portal",{"title":320,"path":321,"stem":322,"children":323,"page":67},"Data Management","\u002Fdata-ops\u002Fdata-management","6.data-ops\u002Fdata-management",[324,328,332,336,340],{"title":325,"path":326,"stem":327},"Adding Products","\u002Fdata-ops\u002Fdata-management\u002Fadding-products","6.data-ops\u002Fdata-management\u002Fadding-products",{"title":329,"path":330,"stem":331},"Adding Vendors","\u002Fdata-ops\u002Fdata-management\u002Fadding-vendors","6.data-ops\u002Fdata-management\u002Fadding-vendors",{"title":333,"path":334,"stem":335},"Framework Mapping","\u002Fdata-ops\u002Fdata-management\u002Fframework-mapping","6.data-ops\u002Fdata-management\u002Fframework-mapping",{"title":337,"path":338,"stem":339},"Refreshing Vendors","\u002Fdata-ops\u002Fdata-management\u002Frefreshing-vendors","6.data-ops\u002Fdata-management\u002Frefreshing-vendors",{"title":341,"path":342,"stem":343},"Reviewing Draft Vendors","\u002Fdata-ops\u002Fdata-management\u002Freviewing-draft-vendors","6.data-ops\u002Fdata-management\u002Freviewing-draft-vendors",{"title":345,"path":346,"stem":347,"children":348,"page":67},"LLM Ops","\u002Fdata-ops\u002Fllm-ops","6.data-ops\u002Fllm-ops",[349,353,357],{"title":350,"path":351,"stem":352},"Agents","\u002Fdata-ops\u002Fllm-ops\u002Fagents","6.data-ops\u002Fllm-ops\u002F1.agents",{"title":354,"path":355,"stem":356},"ESPi Architecture & Query Flow","\u002Fdata-ops\u002Fllm-ops\u002Fespi-architecture","6.data-ops\u002Fllm-ops\u002F2.espi-architecture",{"title":358,"path":359,"stem":360},"Evaluating Agents","\u002Fdata-ops\u002Fllm-ops\u002Fevaluations","6.data-ops\u002Fllm-ops\u002F3.evaluations",{"title":362,"path":363,"stem":364},"Message Queues","\u002Fdata-ops\u002Fmessage-queues","6.data-ops\u002Fmessage-queues",{"title":366,"path":367,"stem":368},"Glossary","\u002Fglossary","glossary",{"id":370,"title":248,"body":371,"description":829,"extension":830,"links":831,"meta":832,"navigation":833,"path":249,"seo":834,"stem":250,"__hash__":835},"docs\u002F4.design\u002F1.design-thinking.md",{"type":372,"value":373,"toc":817},"minimark",[374,388,391,396,399,417,438,441,445,448,532,535,541,544,626,631,634,654,689,695,700,704,711,748,752,756,771],[375,376,377,378,382,383,387],"p",{},"Design thinking is how we keep ESProfiler aimed at a real person with a real constraint, instead of at an abstract \"enterprise CISO\" or a feature list. We start from the ",[379,380,47],"a",{"href":381},"..\u002Fcompany\u002Fproblem-statement"," — the industry evidence for why a living description of the security estate is a necessity — and we work through ",[384,385,386],"strong",{},"named people"," who have to live that problem, not through roles on an org chart.",[375,389,390],{},"The method is broadly to observe the buying committee, name them, give them a point of view, and then use that point of view as a test for every product, copy, and design decision. If we cannot say who it is for and what it lets them do in a decision window, it is not ready.",[392,393,395],"h2",{"id":394},"user-empathy","User Empathy",[375,397,398],{},"A role label is a category. A name is a person you can disagree with and empathise with.",[375,400,401,402,408,409,413,414,416],{},"\"What would a CISO think?\" produces generic, unfalsifiable answers — more dashboard, more coverage, more one-pagers. \"What would ",[384,403,404],{},[379,405,407],{"href":406},".\u002Fpersonas\u002F01-ciso-simon","Simon the CISO"," need to see here?\" produces a specific test: he will not log in, he will not read a report, and he will not survive the board or the consultancy readout with a guess. The work either hands ",[379,410,412],{"href":411},".\u002Fpersonas\u002F02-head-of-cyber-harry","Harry the Head of Cyber"," something ",[379,415,407],{"href":406}," can take into that room, or it does not.",[375,418,419,420,423,424,426,427,426,429,426,433,437],{},"We use a ",[384,421,422],{},"first name plus an alliterative role"," so the name is speakable in a standup, a Figma comment, and a marketing review: ",[379,425,407],{"href":406},", ",[379,428,412],{"href":411},[379,430,432],{"href":431},".\u002Fpersonas\u002F03-security-architect-sasha","Sasha the Security Architect",[379,434,436],{"href":435},".\u002Fpersonas\u002F04-procurement-officer-paige","Paige the Procurement Officer",". Surnames and anonymous \"Persona A\" labels both fail that test: one is too much fiction to remember, the other is too little fiction to care about.",[375,439,440],{},"The names are still composites, not customers. Do not treat them as a substitute for discovery. Treat them as a shared vocabulary so product, design, marketing, and sales are arguing about the same human.",[392,442,444],{"id":443},"how-we-use-personas","How we use personas",[375,446,447],{},"Use them as a decision filter, not as wallpaper in a slide.",[449,450,451,470,482,507,523],"ul",{},[452,453,454,457,458,460,461,463,464,466,467,469],"li",{},[384,455,456],{},"Product."," Before a feature ships, name who it is for. ",[379,459,407],{"href":406}," needs a defensible one-pager; ",[379,462,412],{"href":411}," needs a keep\u002Fcut he can defend against the architecture; ",[379,465,432],{"href":431}," needs ground truth that survives scrutiny without three weeks in consoles; ",[379,468,436],{"href":435}," needs leverage before the notice period dies. If the feature does not change one of those outcomes, it is not the problem we are solving.",[452,471,472,475,476,478,479,481],{},[384,473,474],{},"Design."," Flows, hierarchy, and empty states should match who is actually in the seat. Do not design a dense investigation UI as if ",[379,477,407],{"href":406}," will use it. Do not hide the renewal clock from ",[379,480,412],{"href":411},". Check the work against the persona's Says \u002F Does \u002F Thinks \u002F Feels, not against \"users.\"",[452,483,484,487,488,490,491,493,494,496,497,499,500,502,503,506],{},[384,485,486],{},"Marketing and messaging."," Copy should sound like the person it is aimed at, and we should be clear which persona any messaging is aimed at too. Board-ready defensibility and dollar-mapped risk is ",[379,489,407],{"href":406}," through ",[379,492,412],{"href":411},". Decision windows and overlap findings are ",[379,495,412],{"href":411},". Speed and rigor of evidence are ",[379,498,432],{"href":431},". Notice periods and commercial leverage are ",[379,501,436],{"href":435},". See ",[379,504,291],{"href":505},"..\u002Fmarketing\u002Fmessaging",".",[452,508,509,512,513,515,516,515,518,515,520,522],{},[384,510,511],{},"Sales and customer conversations."," The buying committee is four people, not one economic buyer. Map the room to ",[379,514,407],{"href":406}," \u002F ",[379,517,412],{"href":411},[379,519,432],{"href":431},[379,521,436],{"href":435}," so we know who signs, who champions, who validates, and who owns the clock.",[452,524,525,528,529,531],{},[384,526,527],{},"Critique."," In design reviews and PRDs, \"this is for ",[379,530,412],{"href":411},"\" is a claim you can challenge. \"This is for security leaders\" is not.",[392,533,227],{"id":534},"personas",[375,536,537,538,540],{},"The industry problem they sit in — consultancy reviews, tool sprawl, inventory-as-a-control, and why ESProfiler is a necessity rather than a nice-to-have — is in the ",[379,539,47],{"href":381},". This section is the people. That page is the evidence.",[375,542,543],{},"Each persona has its own page with a quick-facts panel, an org-chart placement diagram, a day-in-the-life narrative, objectives, pain points (with public-research sourcing), relationships, a Says\u002FDoes\u002FThinks\u002FFeels quadrant, and a design\u002Fmarketing angle.",[545,546,547,563],"table",{},[548,549,550],"thead",{},[551,552,553,557,560],"tr",{},[554,555,556],"th",{},"Persona",[554,558,559],{},"Role",[554,561,562],{},"Budget authority",[564,565,566,582,597,612],"tbody",{},[551,567,568,573,576],{},[569,570,571],"td",{},[379,572,407],{"href":406},[569,574,575],{},"CISO",[569,577,578,581],{},[384,579,580],{},"Yes — ultimate",", but rarely sole owner in practice",[551,583,584,588,591],{},[569,585,586],{},[379,587,412],{"href":411},[569,589,590],{},"Head of Cyber \u002F Chief Security Architect",[569,592,593,596],{},[384,594,595],{},"De facto"," — builds the number, doesn't sign it",[551,598,599,603,606],{},[569,600,601],{},[379,602,432],{"href":431},[569,604,605],{},"Security Architect",[569,607,608,611],{},[384,609,610],{},"None"," — influences via evidence",[551,613,614,618,621],{},[569,615,616],{},[379,617,436],{"href":435},[569,619,620],{},"Procurement Officer",[569,622,623,625],{},[384,624,610],{}," — gatekeeper via the contract calendar",[627,628,630],"h3",{"id":629},"how-they-sit-in-the-org","How they sit in the org",[375,632,633],{},"Budget ownership for cyber spend is inconsistent across enterprises and shouldn't be drawn as a single clean line.",[375,635,636,637,643,644,649,650,653],{},"In the majority of large organizations, cyber spend sits inside the CIO's IT budget, with the CIO holding effective allocation power (",[379,638,642],{"href":639,"rel":640},"https:\u002F\u002Fwww.researchgate.net\u002Fpublication\u002F335404794_An_Exploration_of_the_Evolving_Reporting_Organizational_Structure_for_the_Chief_Information_Security_Officer_CISO_Function",[641],"nofollow","Ponemon, 2017"," — 50% of CISOs reporting to the CIO); in a large and growing minority it has its own line answering to the CFO, CEO, or a joint budget committee (",[379,645,648],{"href":646,"rel":647},"https:\u002F\u002Fecs-org.eu\u002Fecso-uploads\u002F2025\u002F01\u002FCybersecurity-Budgets-Ownership-reporting-trends-ECSO-CISO-Community-v1.pdf",[641],"ECSO, 2025"," — ",[384,651,652],{},"45%"," independent of the CIO). Either way, the CISO is rarely the sole named budget owner but is always the one who has to defend the number.",[375,655,656,657,660,661,666,667,670,671,676,677,680,681,684,685,688],{},"That number is typically ",[384,658,659],{},"8–14% of the IT budget"," at this scale — around a tenth, not a rounding error. ",[379,662,665],{"href":663,"rel":664},"https:\u002F\u002Fsf-cdn.iansresearch.com\u002Fsitefinity\u002Fdocs\u002Fdefault-source\u002Freports\u002Fians-2024-security-budget-benchmark-summary-report.pdf",[641],"IANS \u002F Artico"," put security at ",[384,668,669],{},"13.2%"," of IT spend in 2024 (up from 8.6% in 2020); their ",[379,672,675],{"href":673,"rel":674},"https:\u002F\u002Fsf-cdn.iansresearch.com\u002Fsitefinity\u002Fdocs\u002Fdefault-source\u002Freports\u002F2025-security-budget-benchmark-summary-report_08_05_2025.pdf",[641],"2025 summary"," puts the average at ",[384,678,679],{},"10.9%"," after core IT (AI, cloud) grew faster than security. Do not flatten those two years into one fake average. Use ",[384,682,683],{},"8–14%"," as the working band for a $1bn+ \u002F 10,000+ estate; financial services sits at the high end. This is the ",[384,686,687],{},"named cyber programme",", not all security-relevant spend — capability bought in cloud, DevOps, or other departments often sits off that line.",[375,690,691,692,694],{},"The diagram below shows the more common CIO-owned pattern; see ",[379,693,407],{"href":406}," for the branch where the CISO's budget answers to the CFO\u002Fboard committee instead.",[696,697],"mermaid",{":zoom":698,"code":699},"0.5","flowchart TD\n    Board[\"Board \u002F Audit Committee\"]\n    CFO[\"CFO\"]\n    CIO[\"CIO\"]\n    Simon[\"Simon the CISO\u003Cbr\u002F>Accountable for the number,\u003Cbr\u002F>rarely sole owner of it\"]\n    Harry[\"Harry the Head of Cyber \u002F\u003Cbr\u002F>Chief Security Architect\u003Cbr\u002F>De facto allocator, builds the case\"]\n    Sasha[\"Sasha the Security Architect\u003Cbr\u002F>No budget authority — the evidence engine\"]\n    Paige[\"Paige the Procurement Officer\u003Cbr\u002F>No budget authority — owns the contract clock\"]\n\n    Board --> CFO\n    Board --> CIO\n    CFO -.\"financial exposure oversight\".-> Simon\n    CIO -.\"most common: IT budget owner,\u003Cbr\u002F>effective allocation power\".-> Simon\n    Simon -->|\"accountable to\"| Harry\n    Harry -->|\"manages\"| Sasha\n    Paige -.\"flags renewal \u002F notice period\".-> Harry\n    Harry -.\"usage & overlap evidence\".-> Paige\n    Sasha -.\"ground-truth findings\".-> Harry\n    Harry -.\"board-ready, costed case\".-> Simon\n\n    classDef budget fill:#fef3c7,stroke:#92400e,color:#000\n    classDef noBudget fill:#e0e7ff,stroke:#3730a3,color:#000\n    class Simon,CFO,CIO,Board budget\n    class Sasha,Paige noBudget\n",[627,701,703],{"id":702},"the-decision-window-how-the-four-interact-over-time","The decision window — how the four interact over time",[375,705,706,707,710],{},"The four still meet around the same contract lifecycle, but ",[384,708,709],{},"the point in time that matters is different for each role",". A two-year contract is not one scramble at T-90. It has an early health check, a later keep\u002Frenew decision, and a commercial close when the contract actually ends.",[712,713,714,723,735],"ol",{},[452,715,716,719,720,722],{},[384,717,718],{},"In-life checkpoint (architect)."," In the first year, ",[379,721,432],{"href":431}," is with the vendor and product owners: how is it deployed, how are they getting on, are there issues to resolve while there is still time. This is not a keep\u002Fcut. It is an architecture function.",[452,724,725,728,729,731,732,734],{},[384,726,727],{},"Decision window (Head of Cyber \u002F CISO)."," Later, when the contract actually reaches a decision, ",[379,730,412],{"href":411}," needs support for keep, cut, or renew — the interaction we already described. ",[379,733,407],{"href":406}," signs or challenges that recommendation.",[452,736,737,740,741,743,744,747],{},[384,738,739],{},"Commercial close (procurement)."," After that decision is made, as the contract end approaches, ",[379,742,436],{"href":435}," wants the ",[384,745,746],{},"final"," high-level call: do we still need it, and what is the lever for a better deal.",[696,749],{":zoom":750,"code":751},"1","sequenceDiagram\n    participant Vendor as Vendor \u002F product owner\n    participant Sasha as Sasha the Security Architect\n    participant Harry as Harry the Head of Cyber\n    participant Simon as Simon the CISO\n    participant Paige as Paige the Procurement Officer\n\n    Note over Sasha,Vendor: Mid-contract (e.g. year 1 of 2) — architect checkpoint\n    Sasha->>Vendor: How is it deployed, how are they getting on, any issues to resolve early?\n    Vendor-->>Sasha: Status, fit, problems while there is still time to fix them\n    Sasha-->>Harry: In-life status\n\n    Note over Harry,Simon: Decision window — support keep \u002F cut \u002F renew\n    Harry->>Sasha: What does the architecture say we should do?\n    Sasha-->>Harry: Plan, overlap, residual risk\n    Harry->>Simon: Costed recommendation\n    Simon-->>Harry: Sign-off \u002F challenge\n    Note over Harry: Decision made: keep or renew (or cut)\n\n    Note over Paige: Contract end approaching — procurement needs the final decision\n    Paige->>Harry: Do we still need it, and what is my lever?\n    Harry-->>Paige: Confirmed keep \u002F cut \u002F renegotiate\n",[627,753,755],{"id":754},"sources","Sources",[375,757,758,759,761,762,764,765,768,769,506],{},"Public-research claims used across these persona pages are listed on each individual page, with inline links on the numbers. The ",[379,760,436],{"href":435}," ↔ ",[379,763,412],{"href":411}," decision window is labeled as synthesis, not a named survey — see ",[379,766,436],{"href":767},".\u002Fpersonas\u002F04-procurement-officer-paige#what-is-evidenced-vs-synthesized",". Industry-level evidence for why the purchase is a necessity lives on the ",[379,770,47],{"href":381},[449,772,773,780,792,806],{},[452,774,775,779],{},[379,776,778],{"href":639,"rel":777},[641],"Ponemon Institute (2017)"," — 50% of CISOs report to the CIO",[452,781,782,791],{},[379,783,785,786,790],{"href":646,"rel":784},[641],"ECSO CISO Community, ",[787,788,789],"em",{},"Cybersecurity Budgets: Ownership, Reporting, Trends"," (2025)"," — 45% of cyber budgets independent of the CIO",[452,793,794,802,803,805],{},[379,795,797,798,801],{"href":663,"rel":796},[641],"IANS Research, ",[787,799,800],{},"2024 Security Budget Benchmark"," (PDF)"," — security ",[384,804,669],{}," of IT spend (8.6% in 2020)",[452,807,808,802,814,816],{},[379,809,797,811,801],{"href":673,"rel":810},[641],[787,812,813],{},"2025 Security Budget Benchmark",[384,815,679],{}," of IT spend",{"title":818,"searchDepth":819,"depth":819,"links":820},"",2,[821,822,823],{"id":394,"depth":819,"text":395},{"id":443,"depth":819,"text":444},{"id":534,"depth":819,"text":227,"children":824},[825,827,828],{"id":629,"depth":826,"text":630},3,{"id":702,"depth":826,"text":703},{"id":754,"depth":826,"text":755},"How we use named personas to shape product, design, and marketing — and the four people on the buying committee we design for.","md",null,{},true,{"title":248,"description":829},"ceYVlVUsKwYQx7kx2ixMCS6t-taFCAburb5PJb1zRec",[837,839],{"title":244,"path":245,"stem":246,"description":838,"children":-1},"The procurement officer is the gatekeeper of the contract calendar and negotiation process.",{"title":252,"path":253,"stem":254,"description":840,"children":-1},"How design and development collaborate at ESP. A continuous conversation from alignment through implementation, not a handover.",1790076742501]