Blog

Notes from the field

Thinking on SOC engineering, secure development and AI in security — written by the people who build it.

1. 

   14 October 2026 · 12 min read

   What Should We Monitor? How SOCs Define and Prioritise Use Cases

   Four ways SOCs decide what to detect — threat-, risk-, compliance- and data-driven — what each gets right, where each fails, and the layered order that works.

   • SOC Engineering
   • Detection Engineering
   • Security Operations

   Read the article →
2. 

   14 October 2026 · 10 min read

   What Happens When Your Security Tools Know Too Much?

   Search engines saw slivers of your security work. LLMs aggregate and synthesise it on infrastructure you do not control. Seven governance rules for using them.

   • AI in Security
   • Governance
   • Incident Response

   Read the article →