Blog
Notes from the field
Thinking on SOC engineering, secure development and AI in security — written by the people who build it.
-
· 12 min read
What Should We Monitor? How SOCs Define and Prioritise Use Cases
Four ways SOCs decide what to detect — threat-, risk-, compliance- and data-driven — what each gets right, where each fails, and the layered order that works.
Read the article -
· 10 min read
What Happens When Your Security Tools Know Too Much?
Search engines saw slivers of your security work. LLMs aggregate and synthesise it on infrastructure you do not control. Seven governance rules for using them.
Read the article