- SOCSOC Personnel & Workforce: Alert Fatigue Is a Retention Problem
Stress is now the top reason security people leave their jobs. Much of it starts in the alert queue, and most SOC metrics can't see it.
November 2026 · 16 min readRead → - SOCSOC Personnel & Workforce: Talent Shortage vs. Skills Gap, and the Number the Industry Stopped Publishing
ISC2 left its 4.8 million gap estimate out of the 2025 study, and hiring data now tells a messier story.
November 2026 · 19 min readRead → - SOCBuild vs. Buy vs. Co-Manage: RFP Fatigue and How Buyers Separate Real AI SOC Capability from Marketing Claims
Every AI SOC vendor checks every box on your RFP.
October 2026 · 19 min readRead → - NewsExposure Is Half the Story: Why Command Zero Joined Tenable OPEN for AI
Command Zero is a launch partner in Tenable OPEN for AI. Dov Yoran on turning exposure findings into auditable investigations, and why we built Command Zero.
October 2026 · 6 min readRead → - SOCBuild vs. Buy vs. Co-Manage: When Outsourcing Becomes a Liability
A SOC outsourcing contract rarely shows its real cost at signing. It shows up when you try to leave and find your detections, case history, and context live with someone else.
October 2026 · 15 min readRead → - SOCThe Insider Brought an Agent
A departing engineer used an AI coding agent to harvest credentials, delete files and wipe logs in 64 minutes. Here is how an autonomous investigation reconstructed it.
October 2026 · 8 min readRead → - SOCThe Middle of the Shift Map Is Becoming Something You Call
When AI absorbs the middle of the SecOps Shift Map, analysts move left, right, or into agent supervision. Nobody budgets for the ramp. Here is how investigation knowledge travels with them.
October 2026 · 6 min readRead → - SOCBuild vs. Buy vs. Co-Manage: Hybrid SOC Models That Rent the Engineering and Keep the Judgment
Most security teams already run a hybrid SOC. Here is the case for renting the engineering and tooling while keeping analyst judgment in-house, and the places where that split fails.
October 2026 · 14 min readRead → - SOCBuild vs. Buy vs. Co-Manage: The Real Cost of an Internal SOC, MDR, and an AI SOC Platform
Every SOC operating model looks affordable at the size it was priced for. Here is the math on in-house, managed, and AI-driven security operations, and the point where each one stops scaling.
September 2026 · 19 min readRead → - SOCDirection of the Modern SOC: Why MTTD and MTTR Are No Longer the Whole Story
Once machines do first-pass triage and investigation, detection and response times mostly measure the machine. Security leaders need a scorecard that also measures whether the machine was right.
September 2026 · 10 min readRead → - SOCDirection of the Modern SOC: Does the Tiered Model Survive AI?
As artificial intelligence platforms take over initial alert triage, the traditional tiered assembly line model is dissolving into a flatter structure.
August 2026 · 6 min readRead → - InvestigationsInvestigating Browser Backdoors and Access Broker Tooling with Command Zero
Most EDR solutions have shallow visibility inside browser process space creating investigative blind spots.
May 2026 · 19 min readRead → - InvestigationsWelcome to the Casebook
An autonomous analyst opens his case files. Every question, every dead end, every moment a clean theory fell apart. No vendor gloss, no marketing victory laps. Just the work.
May 2026 · 5 min readRead →
See what your team can achieve.
Live in under an hour. No migration. No friction.