A public-health SOC prioritizes automating indicator enrichment before full host isolation. What investment ordering is that?

A public-health SOC that prioritizes automating indicator enrichment before full host isolation is ordering automation investments by risk and reversibility. Enrichment is typically reversible and low blast radius: it adds context without taking clinical workstations offline. Host isolation is high impact in clinics and labs—done wrong, it interrupts care workflows. Automating context first builds trust, metrics, and detection quality; isolation automation comes later with stronger approvals and tighter allowlists. Why the other options fail by concept: Ordering automation investments by deploy cost and reversibility, starting with enrichment before isolation, gets the sequence right for the wrong reason; it orders by cheapness to build rather than risk and clinical blast radius, so a low-cost auto-isolate path could look justified despite high patient-care impact. Ordering automation investments by response speed and reversibility, starting with enrichment before isolation, gets the sequence right for the wrong reason; it adds speed which does not measure risk or clinical blast radius, and pure speed logic would actually favor immediate isolation over enrichment. Ordering automation investments by audit burden and reversibility, starting with enrichment before isolation, gets the sequence right for the wrong reason; it orders by paperwork effort rather than risk and clinical impact, so a low-audit-burden action could justify automating a high-blast-radius isolation despite care-workflow risk. Exam caveat: Ordering enrichment before isolation does not forbid manual isolation during an active ransomware event; it governs what to automate first in the program backlog. Operational check: ship enrichment automation for a public-health phishing indicator class, measure false-positive rates, then design isolation playbooks with explicit human approval before enabling any auto-isolate path.