The miss matters more than the block
A known-bad that slipped past your controls is not the same event as one you stopped. Here's why it rises to the top.
Picture two indicators with the same reputation. One hit your defenses and was blocked. The other walked straight through. Most tools score them identically, because they only look at how bad the indicator is in general. But those are not the same event, and treating them the same buries the one that matters.
A block is your controls doing their job. A bypass is a gap — a known-bad that reached your environment anyway — and it is exactly the thing you would want to see first. Too often it lands in the same undifferentiated queue as everything else, and the signal that your coverage failed gets lost in the noise.
We treat a control bypass as a stronger signal than a block. The misses rise to the top of the queue with the gap called out and tied back to the control that should have caught them, instead of blending in. The point isn't to shame a control; it's to make the gap visible while it still matters.
It quietly changes the question your team works from. Not "what is bad on the internet today," which is a feed anyone can buy, but "what is bad and getting through here," which is your actual exposure. The first is volume. The second is prioritization that reflects your environment.
Coverage gaps should be visible, not silent. Scoring the miss higher than the block is how we keep them that way.
- Bypasses are scored higher than blocks and surface first.
- Every bypass is tied back to the control that missed it.
- Prioritization reflects what's getting through your environment, not raw global badness.