How one payments network does it all: Scaling without headcount, and keeping humans in the loop

Affirm outlines how it scaled security operations by embedding AWS-native telemetry (GuardDuty, CloudTrail, Security Hub) at the organization level, automating account provisioning and tagging, and outsourcing layer-one triage to MDR provider Expel so its small security team can focus on novel detections and automation; the blog emphasizes keeping humans in the loop for remediation decisions and tracks metrics like MTTD/MTTR, alert funnel reduction (4x fewer manual investigations), and operational efficiency.