Most SOCs are treating AI as a way to work through alerts faster, when the real opportunity is turning your best analysts' expertise into something that can be applied everywhere, not only when they're on shift. This series works through what that actually takes — codifying investigative judgement, building the schemas that make it usable, and rethinking what the analyst role becomes once expertise scales past any one person.

  1. Part 1

    Most SOCs Are Thinking About AI the Wrong Way

    The real AI opportunity in the SOC isn't faster triage — it's codifying your best analysts' expertise so it can be applied at scale. Part 1 of a series.