Terrain is what the platform knows about your company, written down where you can read it, correct it, and turn any line of it into a rule triage must follow. Every lead gets read against it. Nothing is used until someone on your team confirms it.
Same signal. Opposite call. One line of Terrain apart.
Most false positives are missing context, not bad rules. Two leads from the same night, both after-hours sign-ins from outside the office, and the only difference between them is what the platform had been told.
Lead 014203:04 ET · Entra sign-ins
Sign-in from Pune, IN for 38 billing accounts, outside business hours
Terrain read
140 billing accounts sign in from Pune until 10:00 ET. Confirmed by J. Moss, Revenue Cycle, Oct 22.
Closed · non-concernReason on the record. Nobody paged.
Lead 014302:11 ET · remote access
Imaging-vendor remote session on PACS-02 from a new account
Terrain read
Treat imaging-vendor sessions outside 08:00 to 18:00 ET as suspicious. Directive, written by an operator after case 4471, confirmed by R. Okafor.
Escalated · confirmation neededContainment waits for Biomed. Case open.
Your board can read it
Four short columns, in plain language.
The Terrain brief is four short columns and the plain answer to "what does our security vendor actually know about us." There is no score to decode and no acronym to look up, so it reads the same to a CFO as it does to the operator who wrote the directive above.
Who you are
You're a 1,900-person specialty care group across 11 clinics in NY and NJ. 240,000 patient records live in your EHR.
What's unknown
The acquired practice in Paramus is mid-integration. 10.88.0.0/16 has no owner on file.
What it holds
Twelve sections. Every line with a source, a confidence and a date.
Terrain is rebuilt from your sources every night and refreshed through the day. Business context, people and exposure groups, crown jewels, technology, locations, vendors, normal behavior, known benign patterns, triage notes, the change calendar, open questions and a confirmation queue. Each fact carries where it came from, how sure the platform is, when the evidence was last seen and who confirmed it.
Crown jewels
A rule before every action.
The systems where a wrong containment call does the most damage each carry a rule triage follows before it acts. Medication cabinets: never isolate, contain at the switch port with Biomed present. The EHR: call Clinical Apps on-call first, downtime procedures take 20 minutes to activate.
BEFORE YOU ACT
Never isolate. Patient safety. Contain at
switch port only, with Biomed present.
Pharmacy · tier 0 · 412 hosts
Directives
Any fact can become a rule.
Add a fact to directives and triage must follow it on every new lead. You see the suggested wording, edit it, publish it. Edits and removals are logged with who and when, the same as every confirmation, every answer and every time someone opens a person's name.
DIRECTIVE · LIVE
Outbound SFTP to the clearinghouse on
Fridays around 4.2 GB is normal. Any
other day, ask Revenue Cycle first.
Based on Known benign · 14 leads · 30d
Coverage
It admits what it doesn't know.
Each area is scored 0 to 100, and the gaps come with ranked steps to close them: answer a question, connect a source, confirm a batch. Questions the platform can't resolve alone sit at the top of the page until a person answers them.
See your own Terrain tomorrow morning.
Connect your sources and the first brief is written the next morning. Confirm what it got right, correct what it didn't, and watch the lead quality change.