Notes from building an autonomous SOC.

Articles

• 6 November 2026 · 6 min read

  Attacks at machine speed

  Breakout times are measured in minutes and exploitation follows disclosure within days. Why a human-paced alert queue cannot keep up, and what has to change.

• 6 November 2026 · 6 min read

  Beyond SIEM rules and playbooks

  Alert floods, brittle playbooks, rules that go blind when log fields change and knowledge that leaves with people. Why the classic SIEM and SOAR model is reaching its limits.

• 6 November 2026 · 7 min read

  Beyond agentic SOC

  Agentic SOC tools chain a frontier model through tool calls, so cost and latency grow with every step and every alert. Why real autonomy must get cheaper as it learns.

• 6 November 2026 · 6 min read

  Local models for SecOps

  Cloud frontier models are costly at SOC volume, add latency and send sensitive logs off-site. Why local, specialised models suit security operations, especially in regulated sectors.

• 6 November 2026 · 6 min read

  Detecting successful web attacks

  WAF and IDS alerts tell you someone tried. The question a SOC must answer is whether the attack worked. Here is how to think about evidence of success.

• 6 November 2026 · 6 min read

  Fixed SOC thresholds

  Static cut-offs in detection and triage quietly encode past analyst habits, including their misses. Why context-aware, verified judgement ages better.

• 6 November 2026 · 6 min read

  Proposal-first remediation

  Automatic containment often lands on backups and legitimate admin work. Proposal-first remediation keeps the speed of automation and the judgement of people.

• 6 November 2026 · 6 min read

  Evaluating external datasets

  Public security datasets can help models learn, or quietly inflate their scores. Data hygiene practices that keep your evaluation honest.

• 6 November 2026 · 6 min read

  One incident per attack story

  Duplicate cases for the same attack waste analyst time and hide the story. Why grouping around the entity and the story, not the rule, cuts alert fatigue.

• 6 November 2026 · 6 min read

  Data-in-use protection

  Database firewalls watch queries at the perimeter, but sensitive data flows through apps and APIs. Why field-level protection of data in use matters.