Opinionated analysis, guides, and expert takes from security operations practitioners.
I closed the ticket in about nine minutes. Weeks later an intel report made me reopen it as a by-hand hunt against old logs. The hunt found nothing, and that empty result was worth more than most of the true positives I have escalated.
I've sat through eight AI SOC demos, each promising to end my team's alert fatigue. By the third I was asking one question first: which part? Too much volume, low-fidelity alerts, and no clear ownership are three different problems, and most demos treated them as one.
A post-incident review took forty minutes to decide an analyst had missed an alert. Her queue held more than 800 alerts that shift, many of them duplicate copies of the same signal. She did not build that queue; the detection pipeline did.
At my last fintech, every endpoint, identity provider, and cloud account fed the SIEM. An attacker still moved laterally for two days without triggering a rule. The logs were present; the detection engineering was not.
My team wanted a noisy recon rule disabled. I pulled six months of its history first and found one true positive: the early recon phase of a red team engagement we'd paid for. Here's how I tune a rule like that instead of killing it.
How to normalize multi-cloud security at the workflow layer across AWS, Azure, and GCP while preserving cloud-specific containment.
Open-source threat intelligence is worth using when it produces measurable incremental value. It's noise when it adds stale, duplicated, low-confidence indicators that raise alert volume without changing an outcome. Here's the six-measure test I run before renewing, adding, or automating any feed.
A security organization scales when its structure matches the work it must perform, the authority it needs to act, and the coverage it can sustain, not when it adds the next box from an enterprise org chart.
The first incident I owned end to end at a mid-market shop, I had every tool I needed and no order to run them in. We recovered, but we relearned the environment from scratch at 2 a.m. instead of reading it off a runbook. Mature DFIR is mostly the runbook.
I ran SOC budget cycles across the whole 2020-to-2026 span, and the line items tell the story better than the vendor decks do. Five shifts were structural: the perimeter moved to identity, log economics broke, automation stopped being optional, detection engineering became a discipline, and AI triage reached production. One thing never moved. Someone still owns the alert at 2 a.m.
I inherited an identity attack surface last year that nobody could describe in a single sentence: an Entra tenant, a still-syncing AD forest, Okta for legacy SaaS, 60 unreviewed OAuth grants, and a service-account inventory in a stale spreadsheet. I now ask every ISPM vendor the same thing: which of my standing exposures do you find, and which one do you actually fix?