Notes from
the agentic SOC
Engineering deep dives, detection practice, threat research, and honest lessons from putting AI agents on real enterprise alert queues.
Latest 61 posts
The Economics Of A 24X7 Soc
Sofia Andersson
Principal Security Researcher
Ai Agents Need Identities Too
Hannah Roth
VP Product
Many Sources One Signal
Sofia Andersson
Principal Security Researcher
What A Tier 1 Analyst Actually Does All Day
Hannah Roth
VP Product
Why We Built Manysignal
Elena Novak
Co-founder & CTO
Siem Migration Without Downtime
Sofia Andersson
Principal Security Researcher
Mttd Is A Vanity Metric
Sofia Andersson
Principal Security Researcher
Soar Is Not Dead It Just Grew Up
David Iwu
Staff Engineer
What Blast Radius Really Means
David Iwu
Staff Engineer
Shadow Ai Is Already In Your Environment
Sofia Andersson
Principal Security Researcher
Log Costs Are A Security Problem
David Iwu
Staff Engineer
Silent Rules Are Worse Than Noisy Ones
Sofia Andersson
Principal Security Researcher
Backtesting Every Detection
David Iwu
Staff Engineer
Rogue Mcp Servers In The Wild
Elena Novak
Co-founder & CTO
The Non Human Identity Explosion
Marcus Hale
Head of Detection
Deduplication Is Underrated
Marcus Hale
Head of Detection
Prompt Injection Is A Detection Problem
Sofia Andersson
Principal Security Researcher
Why Legacy Ueba Failed
Marcus Hale
Head of Detection
Progressive Autonomy Explained
David Iwu
Staff Engineer
The Detection Coverage Illusion
Sofia Andersson
Principal Security Researcher
The Test Keyword Incident
Marcus Hale
Head of Detection
Data Residency In The Gcc
Elena Novak
Co-founder & CTO
When To Replace Your Siem And When Not To
Hannah Roth
VP Product
Entity Resolution Is The Whole Game
Elena Novak
Co-founder & CTO
Turning Soc Work Into Audit Evidence
Sofia Andersson
Principal Security Researcher
Why Similarity Matching Beats Fine Tuning
Marcus Hale
Head of Detection
The Case Against Per Alert Pricing
Hannah Roth
VP Product
Soc Shift Handover Is Broken
Elena Novak
Co-founder & CTO
Detecting Shared Role Abuse
David Iwu
Staff Engineer
How We Think About Autonomy
Marcus Hale
Head of Detection
Hiring Your First Security Analyst
David Iwu
Staff Engineer
Questions To Ask Every Ai Soc Vendor
Elena Novak
Co-founder & CTO
Attack Chains Beat Alert Lists
Sofia Andersson
Principal Security Researcher
The Hidden Cost Of Turning Off Detections
Hannah Roth
VP Product
Cert In Six Hour Reporting
Hannah Roth
VP Product
Building A Sovereign Soc
Hannah Roth
VP Product
Cold Start In Behavioral Analytics
Sofia Andersson
Principal Security Researcher
Peer Group Baselines That Work
Elena Novak
Co-founder & CTO
Evaluating An Ai Soc Vendor
David Iwu
Staff Engineer
Building On Top Of Tines
Hannah Roth
VP Product
Guardrails Are Architecture Not Settings
Hannah Roth
VP Product
Stop Asking Llms To Score Severity
Sofia Andersson
Principal Security Researcher
Post Incident Reviews That Work
Elena Novak
Co-founder & CTO
How Mssps Can Triple Capacity
Marcus Hale
Head of Detection
The Ocsf Migration Nobody Warned You About
Elena Novak
Co-founder & CTO
Tabletop Exercises People Enjoy
Elena Novak
Co-founder & CTO
Clickhouse For Security Telemetry
Elena Novak
Co-founder & CTO
Building A Temporal Entity Graph
David Iwu
Staff Engineer
Service Accounts Are Your Biggest Blind Spot
Elena Novak
Co-founder & CTO
State Vs Events In Security Data
Elena Novak
Co-founder & CTO
Metrics That Actually Predict Outcomes
Hannah Roth
VP Product
What We Learned Triaging A Million Alerts
Marcus Hale
Head of Detection
The Triage Problem Nobody Solved
David Iwu
Staff Engineer
Why Your Siem Cannot Answer Simple Questions
Sofia Andersson
Principal Security Researcher
Hipaa 164 308 Explained
Sofia Andersson
Principal Security Researcher
Your Workflows Are Production Code
Marcus Hale
Head of Detection
Determinism Is A Feature
David Iwu
Staff Engineer
Why Config Snapshots Beat Logs
Sofia Andersson
Principal Security Researcher
The Agentic Soc Is Not A Chatbot
Marcus Hale
Head of Detection
The Analyst Feedback Loop
Marcus Hale
Head of Detection
Stay sharp
New posts on detection engineering, AI agents, and SOC practice — delivered weekly. No noise.
Unsubscribe any time. No spam.