Insights from the front line.

Every SOC operating model looks affordable at the size it was priced for. Here is the math on in-house, managed, and AI-driven security operations, and the point where each one stops scaling.

Once machines do first-pass triage and investigation, detection and response times mostly measure the machine. Security leaders need a scorecard that also measures whether the machine was right.

When AI can pick up, investigate, and close most alerts faster than a person, the queue stops being the analyst's job description, and security leaders are still working out what replaces it.

As SIEM, SOAR, XDR, and AI-SOC platforms blur into each other, security leaders are re-litigating a decades-old question: one throat to choke, or the best tool for every job?

Taking action on what AI cyber agents find is a different problem than actions from what a human agent finds, and security leaders are learning to draw the line between the two.

As artificial intelligence platforms take over initial alert triage, the traditional tiered assembly line model is dissolving into a flatter structure.

SOAR playbooks just moved the bottleneck from analysts to the engineers maintaining brittle scripts. The fix is a hypothesis-driven investigation model that reasons through evolving evidence

The Build vs. Buy Calculation

By the Time a Case Reaches Tier 3, It’s Already a Mess

Building Curiosity and Investigation Culture, Not Just Skills

Fifty-one seconds. That's the timeline your SOC is competing against. The question is whether your investigation architecture is designed to compete at all.

A Different Approach: Evidence Before Inference

Other Must-Attend Community Events

The Front Door Is Wide Open. Why Legacy SOC Architecture Can’t Keep Up.

The barrier to AI-powered security operations isn't model sophistication—it's fragmented architectures across 83+ security tools that create impossible environments for autonomous agents to navigate.

After three decades building security software and leading multiple successful exits, I can tell you with certainty: AI in Security Operations Centers isn't a future consideration—it's an urgent prese

During my two decades defending networks and investigating threats, I've never witnessed transformation this profound. AI is revolutionizing security operations unlike any other tectonic shift has don

Picking the right tier structure for your SOC

Centralized data systems like SIEMs and data lakes excel at detection, reporting and compliance, but fall short for complex security investigations.

SOC automation and SIEM segments in flux