Playing from the Same Sheet of Music: How a Pacific Northwest Health Plan Turned 56 Data Sources into One Source of Truth for Its Security Organization
“
“We're not sifting through noise to find signal anymore. We're just talking about signal. Onyxia has allowed me to move the team forward in a way we weren't a couple of years ago.”
CISO of Leading Health Plan
Key Outcomes and Benefits
56+ Security Tools
Seamlessly integrated within the platform.
HITRUST Alignment
Continually tracked in real time
Protecting Members
The main focus of the security mission
About the Client
A leading non-for-profit health plan in the Pacific Northwest.
They provide health and insurance programs and initiatives to employers and individuals.
The Challenge: Too Much Information, Too Little Sense-Making
For the health plan’s CISO, the problem was never a shortage of data. It was the volume of it.
"CISOs are inundated by a lot of information," he said. "There's an expectation that you build your technology stacks, bring people, process, and technology together, and drive toward a mission of protecting and defending. The ones doing truly interesting things are enabling and innovating within their companies. But you can't get to enablement and innovation if you're caught in the weeds."
A CISO's day moves constantly between the strategic, the operational, and the tactical. Without a way to make sense of incoming telemetry, he found it hard to even know which questions to ask. "You don't even know the right questions until you start parsing through the data in a meaningful way," he said.
Before Onyxia, that parsing happened in Excel spreadsheets and meetings. At each monthly business review, every team brought its own highlights, pros and cons. "We would sit there for four hours, five hours, and try to work through it. What does this mean?" he then had to layer in his own view of everything else happening across the company.
One Sheet of Music for Three Teams
The health plan’s security organization is built around three teams: Threat, Engineering, and Compliance. Onyxia gave the three teams a common foundation. With 56 data sources now ingested into the platform, each team works from the same telemetry and the same understanding of the program.
"When I ask, you're going to play the tuba, you're on drums, you're on guitar — cool. But I can't have them playing three different songs," the CISO said. "Onyxia helps them play the same song, based on the same music and the same telemetry."
His direct reports now meet daily and use that shared data to prioritize, sequence work, plan resources, solve problems, and scenario-plan. "It doesn't become reality until you ground it in data and fact," he said. "There's something to be said for: the data says this, so what are we arguing about? Once we agree on that, we can start elevating the conversation."
The monthly business reviews still happen, because he values giving his teams a voice. But they are far shorter and more effective. "We're not sifting through noise to find signal," he said. "We're just sitting there talking about signal. Onyxia has allowed me to move the team forward in a way we weren't a couple of years ago."
Continuous Compliance in a Highly Regulated Industry
As a health plan, the client operates under HIPAA, SOC 1 and SOC 2, and state audits. HITRUST is one of its primary frameworks, and when the team moved from HITRUST v9.5 to v11.7, Onyxia released support for the new version so the health plan could map its telemetry directly to it.
"HITRUST is very prescriptive about how things are supposed to be done," he said. "It's very clear for control owners to understand what good looks like and what they're supposed to do. The ability to communicate that out has been huge for us."
The bigger shift is timing. Instead of discovering deviations once a year, the team sees them as they happen. "When the auditors do come, they're pulling samples," he said. "The ability to course-correct quickly by having the right data at hand makes all the difference. If you ask me, I think we're great — but what does the data say? What does the control say? That's where Onyxia helps us."
Advice for Fellow CISOs
When it comes to adopting a technology like Onyxia, the health plan CISO's recommendation to peers is direct. "The accountability is too high, and the speed of change is so significant that you need all the help you can get," he said. "If you don't do things like this, you're doing a disservice to your organization, and you're probably doing a disservice to yourself. We need to be more intentional about what that help looks like, and then go make it happen."