Security Operations
As AI takes over routine investigation, the SOC analyst directs the AI, investigates the novel and leads incidents, and developing people for that role needs deliberate design.
Security Operations
Playbooks pose the questions, queries gather the evidence, detections explain why the alert fired, and skills carry the procedure — codification is how you turn analyst expertise into something AI and analysts can both reason over. Part 2 of a series.
Security Operations
The real AI opportunity in the SOC isn't faster triage — it's codifying your best analysts' expertise so it can be applied at scale. Part 1 of a series.
Incident Response
Why structured hypotheses, not more tooling, are what turns SOC alert-chasing into evidence-based investigation.
Incident Response
The one question — 'so what?' — that separates analysts closing alerts fast from analysts actually reducing risk.