Most SOCs are treating AI as a way to work through alerts faster, when the real opportunity is turning your best analysts' expertise into something that can be applied everywhere, not only when they're on shift. This series works through what that actually takes — codifying investigative judgement, building the schemas that make it usable, and rethinking what the analyst role becomes once expertise scales past any one person.

  1. Part 1

    Most SOCs Are Thinking About AI the Wrong Way

    The real AI opportunity in the SOC isn't faster triage — it's codifying your best analysts' expertise so it can be applied at scale. Part 1 of a series.

  2. Part 2

    Codification: The Missing Foundation of the AI-Ready SOC

    Playbooks pose the questions, queries gather the evidence, detections explain why the alert fired, and skills carry the procedure — codification is how you turn analyst expertise into something AI and analysts can both reason over. Part 2 of a series.