AI in the SOC — Thought leadership

Thought leadership

Opinion and research from vendors and researchers that is not about a specific announcement.

Eventus Security on LinkedIn · 15 Oct 2026

Choosing a Managed SOC is not just about threat detection. It’s also about trust, data sovereignty and accountability. Your SOC has visibility into far more than threats. It handles sensitive security telemetry, user activity, incident evidence and investigative data.

Huntbase on LinkedIn · 14 Oct 2026

Credit first: @TheM3gatr0n on X published research this week on Operation CAIRN, what they describe as an autonomous AI attack platform found running in the wild.

Kai Security on LinkedIn · 14 Oct 2026

Letting a machine fix what it finds is a governance decision as much as a technical one. 👨⚖️ Alfredo Hickman , Kai CISO, explains why in The AI Journal . AI has made finding risk fast, and he argues the next step is letting machines act on it in proportion to the evidence.

Cylerian on LinkedIn · 14 Oct 2026

How much alert noise can you cut without letting a single threat slip past? We ran System 1 on 4,564 live enterprise alerts and swept the confidence threshold from 0.1 to 0.9. On Jev, every threshold from 0.1 to 0.5 sent 100% of malicious alerts to Cyra.

Prophet Security on LinkedIn · 14 Oct 2026

14% of security practitioners in our State of AI in Security Operations 2026 survey turned off a detection rule because they couldn't keep up with what it produced. Another 26% said they could see themselves doing it.

Bricklayer AI on LinkedIn · 14 Oct 2026

What does it take to put agentic AI to work in enterprise security? The hardest parts of building a multi-agent system for enterprise security are often the ones you don't see in a demo.

Stellar Cyber on LinkedIn · 14 Oct 2026

THE PYRAMID OF INFLUENCE...1 YEAR LATER. Last year, Christophe Briguet introduced the idea that not all feedback was created equal. Check out this new blog in Cybercrime Magazine about what we've been able to prove after a year of trials. The bottom line?

Arambh Labs on LinkedIn · 14 Oct 2026

Security teams spent a decade teaching everyone that one proof isn’t enough. Password and phone. Badge and face. Then an alert comes in, and it gets closed on a single signal. The IP is known. The hash was seen before. The user is on an allowlist.

HawkEye on LinkedIn · 14 Oct 2026

Faster development doesn’t automatically mean safer code. When an AI assistant recommends malicious or insecure code, the consequences can extend far beyond a single developer’s workstation.

Kai Security on LinkedIn · 13 Oct 2026

Some of the best questions in security never get asked, because nobody on the team has the hours. ⏳ Galina Antova , our co-founder and CEO, wrote about what changes when that limit goes away.

Splunk on LinkedIn · 13 Oct 2026

"AI is hungry for data, but can enterprises keep up with its appetite? According to the Machine Data Outlook Report, 74% of technology leaders say AI and automation are creating significant data management challenges, while 53% frequently lack the machine data needed to power…

Wirespeed on LinkedIn · 13 Oct 2026

A calculator solves a math problem instantaneously, and it's right every time. ➕➗ AI can solve it, too. It just takes longer. ⏳ When it comes to your security, wouldn't you prefer a tool that gets there faster (and cheaper)?

Kai Security on LinkedIn · 13 Oct 2026

An AI discovery engine flagged eight vulnerabilities as critical. After independent review, only one kept that rating. ☝️ Chris Pedigo , our VP of Solution Engineering, argues that teams building AI into vulnerability management should read that result as a specification for how…

Exabeam on LinkedIn · 13 Oct 2026

Ask a security leader what scares them most right now, and the answer isn't hackers. It's their own AI agents. We surveyed 600 security and finance leaders, and 48% now rank AI agents with excessive, compromised, or unintended access as the single greatest threat to their…

Arctic Wolf on LinkedIn · 13 Oct 2026

As AI transforms security operations, trust and visibility will be just as important as speed and automation. Read more from Arctic Wolf President and CEO Nick Schneider 's conversation with CRN : https://bit.ly/4yk5SHx On stage at the 2026 XChange Best of Breed Conference, Nick…

Splunk on LinkedIn · 13 Oct 2026

Agentic AI demos are cheap. Production is where the real costs show up. Yep, agentic AI projects often stall before launch, from runaway token usage to skipped evaluations and guardrails that cost too much to run.

Cotool on LinkedIn · 13 Oct 2026

Here's our co-founder and CEO Max Pollard on the time he network-contained himself in the middle of a demo. About a year ago, he hit approve when he meant to hit reject, and dropped out of the demo. With the tools available back then, getting back online took 30 to 45 minutes.

Anvilogic on LinkedIn · 13 Oct 2026

“AI-native” became an RFP checkbox. Most security vendors check it. Few can back it up. In Forbes, our Founder and CEO Karthik Kannan lays out four questions to ask any vendor before the pilot: 1. Does it know your environment, or just the internet? 2.

Sevii on LinkedIn · 13 Oct 2026

Attackers can exploit new vulnerabilities within minutes. Why wait for an alert to act? In a new feature from SaaSTake , Sevii CEO & Cofounder Curt Aubley discusses how Sevii’s Autonomous Preemptive Security (APS) module is changing the way organizations defend against emerging…

D3 Security on LinkedIn · 13 Oct 2026

COST TO SERVE DECIDES THE DECADE The MDR market is splitting along one line. Providers whose “cost to serve” falls as they grow, and providers whose cost grows with every client signed.

Exaforce on LinkedIn · 13 Oct 2026

A login from a new network looks identical in the logs whether it belongs to a read-only user or an over-provisioned super admin. It should not get the same priority.

Stellar Cyber on LinkedIn · 13 Oct 2026

DON'T MISS THE FOREST FOR THE TREES. Don't miss the signal for the alert. Daniel L. from Cyflare talks about the importance of looking at the signal, rather than the alert, when approaching security operations.

BlinkOps on LinkedIn · 13 Oct 2026

A verdict is half the job. Benign or malicious. That's where most AI SOC tools stop. And that's only half the job. It's also not always a binary question. Say a detection fired 847 times last month. 812 were auto-closed as benign. Looks great on the dashboard.

Secure.com on LinkedIn · 13 Oct 2026

A scanner that finds 4,000 vulnerabilities hasn't helped you. It's just moved the hard part onto your desk. Now someone has to figure out which of those 4,000 actually matter, and the scanner can't help with that. See what proof looks like → https://lnkd.in/dfecwm_r

Crogl on LinkedIn · 12 Oct 2026

NEW on the Crogl blog: 5 Requirements for Autonomous SOC in On-Prem & Air-Gapped Environments. Evaluating autonomous SOC platforms for a regulated or air-gapped environment? Feature lists won’t tell you what you need to know. Architecture will.

Simbian on LinkedIn · 12 Oct 2026

Claude Haiku 5.5 runs a threat hunt for about a cent. Then it stops at 10% of its turn budget. We ran Anthropic's newest small model on the Cyber Defense Benchmark (October 2026 leaderboard). It placed 28th of 30 and found 9.3% of the attack.

Kai Security on LinkedIn · 12 Oct 2026

One attacker using frontier AI models has gone after at least nine South Korean banks since late September. 🏦 Shinhan Bank alone reported about 25,000 customers' personal information compromised, and investigators believe AI models did much of the work that let a single person…

Exabeam on LinkedIn · 12 Oct 2026

An attacker doesn't need to look suspicious. They just need to look like a normal user long enough to access sensitive data. Rules-based detection is tough in this scenario because the credentials are valid.

D3 Security on LinkedIn · 12 Oct 2026

ONE ALERT NAME, FOUR INCIDENTS “Credential Access, Treasury Account.” That alert is a genuine compromise, a scheduled password rotation, a VPN connection misread by geolocation, or a service account doing its job. The alert name cannot tell you which.

Arambh Labs on LinkedIn · 12 Oct 2026

The most effective phish we’ve seen this quarter didn’t fake chatgpt.com . It ran on the real thing. A sponsored Google ad for “chatgpt” opened a Custom GPT called “Plus 5.6” on the real ChatGPT site.

Binalyze on LinkedIn · 12 Oct 2026

Attacks break out in 28 minutes; SOCs take 37 to act. That's the gap at the heart of our 2026 State of the SOC Report, built on a survey of 400 CISOs and senior IT leaders across the US and UK. The big finding? SOCs don't have an alert problem. They have a truth problem.

HawkEye on LinkedIn · 12 Oct 2026

Your most dangerous employee has no name, no manager and no MFA. Seven steps take an attacker from one phished credential to a hidden service account they can walk back in through. Once an AI agent is hijacked, the chain moves even faster.

DeepTempo on LinkedIn · 11 Oct 2026

AI is making ransomware operators more efficient. In research posted October 9, Atos Threat Research Center describes an exposed server associated with an INC-affiliated ransomware operator.

Strike48 on LinkedIn · 11 Oct 2026

Before an AI agent is allowed to handle cyber threats on its own, it has to prove itself. Md. Abul Kalam Azad,CISSP,CISA,CISM, CRISC , CISO at Eastern Bank PLC, sets the threshold at 95% detection accuracy: an AI must automatically catch 95 out of 100 attacks in testing before…

Palo Alto Networks on LinkedIn · 10 Oct 2026

AI is accessing more enterprise data and increasingly taking action with it 🔐 This blog unpacks what the 2026 OWASP Top 10 for LLM Applications reveals about managing agentic access, protecting sensitive context, and securing data integrity: 🟠 #1 Prompt Injection 🟠 #2 Sensitive…

DeepTempo on LinkedIn · 10 Oct 2026

A trusted agent can still be an untrusted entry point. Zenity's October 8 AgentCorruption research describes how access to one public-facing AWS AgentCore agent could expose credentials and reach other agents in the same account and region.

CrowdStrike on LinkedIn · 9 Oct 2026

The exploit window is shrinking. The adversary is accelerating. Frontier AI is removing the friction that once slowed cyberattacks — accelerating vulnerability discovery, exploitation and attack execution. Security teams can’t fix everything.

CrowdStrike on LinkedIn · 9 Oct 2026

Threat intel is only as useful as the action it drives. What changes when AI agents can help close the gap between research and response, while keeping analysts in control? Watch the full lightboard to see it in action: https://lnkd.in/eM7u3E5V

Tuskira on LinkedIn · 9 Oct 2026

“It’s easier than ever to find vulnerabilities, but verifying, prioritizing, and fixing these findings remains challenging.” Anthropic wrote this week in its Cyber Mission launch that, after Project Glasswing scanned hundreds of open-source projects, it still hadn’t produced…

7AI on LinkedIn · 9 Oct 2026

Most security teams already know what good security looks like. The challenge is delivering it every time with the people, budget and hours they have. Israel Barak 's new CSO Online article explains how to pick a first AI use case.

CrowdStrike on LinkedIn · 9 Oct 2026

Threat actors would rather log in than hack in. As adversaries evolve their reasoning in seconds, compromised credentials give them a direct path into the enterprise, making identity one of the most critical battlegrounds in modern cybersecurity.

Arctic Wolf on LinkedIn · 9 Oct 2026

Cyber threats move at machine speed. Security operations should too. Read the perspective from LoneStar Advisory & Research: https://bit.ly/4hw0KuL LoneStar Advisory & Research's Will Townsend takes a closer look at the Arctic Wolf Aurora Agentic SOC and how its agent-led…

Stellar Cyber on LinkedIn · 9 Oct 2026

YOU HAVE ALL THE TOOLS. But something's still...not working. The issue isn't that you haven't agglomerated the right security tools, or enough of them.

Splunk on LinkedIn · 9 Oct 2026

Security analysts don’t need more alerts. They need the right context. Risk-based alerting helps SOC teams connect signals, prioritize real threats, and spend less time chasing noise.

Command Zero on LinkedIn · 9 Oct 2026

A new term showed up in security hiring this week: the “Level 1.5” analyst. It comes from a report Rogers Cybersecure Catalyst released on October 7, built on consultations and roundtables with employers and security practitioners.

Artemis Security on LinkedIn · 9 Oct 2026

Artemis runs millions of defensive operations across enterprise environments such as detection, investigation, threat hunting, and incident response. We post-trained Orion-1 to master those operations.

Sevii on LinkedIn · 9 Oct 2026

Automation vs Autonomy: A playbook can only take you so far. Reasoning changes the game. Traditional security automation executes predefined workflows.

7AI on LinkedIn · 9 Oct 2026

The SIEM made sense when your data lived in one data center. Today it's spread across cloud platforms, SaaS apps, and data lakes, and security teams are paying to copy all of it into one place.

Conifers AI on LinkedIn · 9 Oct 2026

If AI can investigate an attack in minutes but response and containment takes hours, the attacker still has time to act. That gap is why cybersecurity may be one of the first enterprise functions to move AI from copilot to autonomy.

Elastic on LinkedIn · 9 Oct 2026

Same agent, same model, same question. 71% fewer tokens. Connecting an agent to enterprise data works in the demo. In production it spends most of its budget on discovery: what the schemas are, what the fields mean, how entities relate across sources.

Cylerian on LinkedIn · 8 Oct 2026

“How far do you trust the AI?” is the wrong question. Cylerian agents investigate alerts on their own and stay read-only. The only way they change anything is through Actions, and each Action has its own approval policy. Closing a benign alert: fully autonomous.

Fortinet on LinkedIn · 8 Oct 2026

Cybercriminals already know how to collaborate. Defenders have to be just as connected. In a new SC Media article, Derek Manky of #FortiGuardLabs explains why disrupting AI-enabled cybercrime requires industry, government, and law enforcement to work together.

Simbian on LinkedIn · 8 Oct 2026

Sonnet 5 scored 17 points below Sonnet 4.6 on our Cyber Defense Benchmark. Opus 4.8 lost almost 12 points against Opus 4.6. Grok 4.7 slipped below Grok 4.6 too. Part of the drop is how long a model keeps looking.

Prophet Security on LinkedIn · 8 Oct 2026

"What happens to my team?" That question comes up in nearly every conversation about AI in the SOC. "The SOC will not shrink by 2030" is the answer from Gartner's new report, The Roles Required for the AI-Enabled Security Operations Center (SOC) by Pete Shoard.

Kai Security on LinkedIn · 8 Oct 2026

"We can never step away from all the security guardrails and process when we're doing testing." 💯 Kai Co-Founder and CEO Galina Antova spoke with Kyle Alspach at CRN about what the recent rogue AI agent incidents should teach security teams.

DeepTempo on LinkedIn · 8 Oct 2026

Learning together should not mean handing over your raw data. On October 2, Google Research described a federated-learning system built around verifiable privacy and auditable access policies.

Kai Security on LinkedIn · 8 Oct 2026

48% of CISOs say a quarter or more of their known vulnerabilities stay open for longer than 30 days. 📊 In our 2026 State of Autonomous Defense survey of 500 CISOs, 17% put that share at half or more.

Palo Alto Networks on LinkedIn · 8 Oct 2026

AI agents are acting on their own. Security can’t afford to lose sight of them 👀 As agents spread across the enterprise, organizations need to know where they are, understand their risk, and stop unauthorized actions in real time ⚡ See how Prisma AIRS helps secure AI agents from…

Leidos on LinkedIn · 8 Oct 2026

Airport security has changed dramatically over the past 25 years ✈️ The next challenge is making it more adaptive and efficient without losing sight of its core mission: keeping people safe.

Secure.com on LinkedIn · 8 Oct 2026

A botnet just quietly took over 3,400 servers, and it didn't need a clever AI exploit to do it. It needed AI servers left exposed on the open internet, which turned out to be easy to find. Full breakdown below.👇

Binalyze on LinkedIn · 8 Oct 2026

Every security team eventually faces the same question: "We have the alert... now what?" That question sits at the heart of our latest CIO Times feature. At Binalyze, we believe investigation deserves the same attention the industry has given prevention and detection.

Qevlar on LinkedIn · 8 Oct 2026

Your SOC can close every case faster with AI and still fail to answer: did the attacker get what they came for? Part of the problem is that attackers give AI an objective to achieve, while defenders give it a queue of tasks to complete.

Eventus Security on LinkedIn · 8 Oct 2026

Saudi enterprises are transforming fast. Security operations can't afford to become the bottleneck. • New cloud workloads. • New digital services. • New identities. • New applications. • New integrations.

CrowdStrike on LinkedIn · 7 Oct 2026

New CrowdStrike Cyber Superintelligence Lab research examines how attackers could circumvent LLM safety classifiers by breaking harmful tasks into benign requests and reassembling the outputs.

Kai Security on LinkedIn · 7 Oct 2026

60% of organizations still take more than a week to fix a critical vulnerability, while attackers can find and exploit one far faster. 🔐 Alfredo Hickman , our CISO, puts the problem on the operating model.

ServiceNow on LinkedIn · 7 Oct 2026

If a small team in a garage were building a company to put you out of business, what would they be working on? That's the question Jon McNeill , co-founder & CEO of DVx Ventures and former president of Tesla, uses to force a real answer out of leadership teams.

7AI on LinkedIn · 7 Oct 2026

The AI threat is arriving faster than the org charts built to handle it. Greg Hanniman on why AI deserves dedicated people and what he's telling his executive leadership to get there. Hear more. #BlackHat #cybersecurity #agenticsecurity Audience 1st Dani Woolf

Spectrum Security on LinkedIn · 7 Oct 2026

If you haven't seen the Spectrum Threat Graph yet, you're missing out. It visualizes end-to-end how Spectrum works: - Identify threats that matter to your environment - Map threats to techniques for detecting them - Find all relevant procedures for writing or fixing detections …

Strike48 on LinkedIn · 7 Oct 2026

As AI agents absorb routine alert triage, human work is pivoting from manual queue monitoring to case validation, AI-aware workflow engineering, and proactive exposure management.

DeepTempo on LinkedIn · 7 Oct 2026

Only 11% of nearly 400 businesses surveyed could accurately forecast their AI spending, according to a study cited by The Wall Street Journal this week. That should concern anyone building an AI SOC. Attackers can scale the work they create.

Prophet Security on LinkedIn · 7 Oct 2026

“SOC Engineers in 2030 are a blend of threat expertise, data fluency, and AI system design to prevent fragile automation from becoming the next source of operational risk.” In this report, Gartner discusses: 🦾 How L1/L2 roles are evolving and what to change in training and…

Palo Alto Networks on LinkedIn · 7 Oct 2026

Frontier AI gives threat actors the power to weaponize vulnerabilities in minutes, not weeks. Palo Alto Networks Unit 42 has seen attackers use AI to slash attack speeds by up to 97%.

Arambh Labs on LinkedIn · 7 Oct 2026

Every office poster this month says the same thing: report phishing. Good advice. Nobody argues with it. But here's the part the poster leaves out: someone on the other side has to open every one of those reports.

Backline AI on LinkedIn · 7 Oct 2026

Two years of model releases. Syntax correctness on AI-generated code climbed from roughly 50% to 95%. Security pass rate over the same stretch: 55%, then 55%, and still 55%. Veracode's Spring 2026 GenAI update ran it by language. Python passes 62%. C# 58%. JavaScript 57%.

Exabeam on LinkedIn · 6 Oct 2026

Duncan Riley at SiliconANGLE & theCUBE takes a closer look at how Exabeam is advancing the agentic SOC. His reporting highlights a shift underway: AI agents are moving from point assistance to persistent investigation, while human judgment remains central to how security teams…

Fortinet on LinkedIn · 6 Oct 2026

CISA’s new guidance on cyber decoys gives defenders a practical framework for turning that signal into action, from honeypots and honeytokens to breadcrumbs and tripwires.

Torq on LinkedIn · 6 Oct 2026

Just in from TechTarget 👀 At the CyberRisk Alliance Cybersecurity Summit this week, Torq's Briana Clark shared findings from our AI SOC Leadership Report: 97% of security leaders believe AI can handle alert triage. Only 35% have actually deployed it.

Cylerian on LinkedIn · 6 Oct 2026

How much is your firewall actually blocking? Most teams can’t answer in under a minute. We did it in one query. 24 hours of firewall telemetry → one donut and a ranked bar chart. The verdict: 30.7% of traffic denied. Accept 40k. Drop 22k. Reject 15k.

Kai Security on LinkedIn · 6 Oct 2026

94% of UK CISOs told us they're ready for AI-accelerated attacks, while only 33% said they're strongly confident in that readiness. SecurityBrief UK covered what sits underneath those numbers in our UK research, with Nick Degnan , our Chief Revenue Officer weighing in.

D3 Security on LinkedIn · 6 Oct 2026

A BREACH SHOULDN'T BE A BILLING EVENT Prospects keep flagging the same pricing trap: AI SOC tools that charge by investigation. By remediation. By usage. Think about the incentive. Your worst week becomes your biggest invoice.

Binalyze on LinkedIn · 6 Oct 2026

When an incident is unfolding, an information vacuum can quickly become part of the problem. The latest coverage of the suspected ASOS incident, now on AOL, reports that the group behind the notification has made a further claim; this time saying payment information is not…

DeepTempo on LinkedIn · 6 Oct 2026

A faster SOC is not automatically a safer SOC. Yesterday, Ars Technica reported on prompt-injection attacks that cross trust boundaries between AI agents. An instruction passed along by another agent can look trusted even when it started with an attacker.

Stellar Cyber on LinkedIn · 6 Oct 2026

SO...WHAT EXACTLY IS ISOC? You may or may not have heard of Gartner's new category: the Integrated Security Operations Center, or ISOC. But what does it mean for the industry, and what does it mean for your business?

Palo Alto Networks on LinkedIn · 6 Oct 2026

95% of critical infrastructure leaders are bracing for Frontier AI-powered attacks. Our State of Critical Infrastructure Cybersecurity Report reveals a widening gap: while 29% of CVEs are exploited within 24 hours, legacy OT environments average 55 days to deploy a patch.

BlinkOps on LinkedIn · 6 Oct 2026

Your SOC gets the same phishing alert three times. A pure-reasoning agent investigates it three different ways. Different paths. Different verdicts. Nothing you can test or audit. That variance is the real production problem, and a smarter model doesn't fix it.

Binalyze on LinkedIn · 6 Oct 2026

Attackers don’t just exploit systems. They exploit pressure. Following reports that thousands of ASOS customers received a notification claiming the retailer had been hacked, Binalyze VP of Market Strategy Marie Wilcox spoke to The Guardian about the incident and the pressure…

Secure.com on LinkedIn · 6 Oct 2026

This week, an AI agent hacked the people whose entire job is finding everyone else's vulnerabilities. Clumsy enough that its victim called the attack "loud and very messy." It reached root in seconds anyway. Full breakdown.👇

Spharaka on LinkedIn · 6 Oct 2026

Not every AI SOC is autonomous. Most products sold as an AI SOC still hand the real work to an analyst. The difference comes down to who investigates, and who decides. 01 AI-assisted SOC: AI summarises and enriches alerts. An analyst still investigates every one.

Kai Security on LinkedIn · 5 Oct 2026

AI agents tried to break into the website of Library and Archives Canada, even though nobody told them to. 🤖 Transluce , the research nonprofit that flagged it, said the attempt failed. Inside enterprises the same behavior is showing up.

Splunk on LinkedIn · 5 Oct 2026

In the race to agentic AI, the real advantage might be knowing when not to hit the gas. For partners, the opportunity coming out of #splunkconf26 isn’t just about deploying more AI.

ServiceNow on LinkedIn · 5 Oct 2026

Most companies are investing in AI. MIT professor and digital economy researcher Sinan Aral says what actually unlocks the value isn't the technology—it's everything you change around it. Skip that, and you're just hooking a horse up to a car.

CrowdStrike on LinkedIn · 5 Oct 2026

What happens when attackers stop running out of time? Or patience? Or options? Frontier AI is changing the constraints that have shaped cyber offense for decades, giving adversaries new ways to explore attack paths, exploit weaknesses, and pursue opportunities at machine speed.

D3 Security on LinkedIn · 5 Oct 2026

Mate Security on LinkedIn · 5 Oct 2026

Straight from Mate Labs 🧪 Our customers lead some of the biggest, most valuable enterprises out there. They need security products that are on the cutting edge of technology, defend them at scale, and are easy to use.

SentinelOne on LinkedIn · 5 Oct 2026

An AI coding assistant with full system permissions installed a trojanized LiteLLM package on its own. No human reviewed the update. SentinelOne caught the attack the same day it launched.

Intezer on LinkedIn · 5 Oct 2026

"We can't not have level one analysts." That was GM Financial 's AVP of Cyber, David Barron's answer when we asked during AI SOC Live how AI is changing the entry-level analyst role. His reasoning is simple. Level threes eventually retire.

Intezer on LinkedIn · 5 Oct 2026

Arctic Wolf on LinkedIn · 5 Oct 2026

7AI on LinkedIn · 5 Oct 2026

Legacy MDR runs on a shared bench of analysts, so its capacity grows only as fast as the provider can hire. Alert volume grows at machine speed.

Spectrum Security on LinkedIn · 5 Oct 2026

Fixing your SecOps starts with detection - but that shouldn't mean you have to rip out your SIEM. Here are some of the SIEMs Spectrum works with today: Splunk , Google SecOps, Microsoft Sentinel, Elastic , Sumo Logic , Databricks , and CrowdStrike .

Arctic Wolf on LinkedIn · 5 Oct 2026

When we set out to build the Aurora Agentic SOC, we didn't just want to make triage faster. We fundamentally re-engineered our SOC to strengthen every job it does, and enhancing the Concierge Experience for our customers was a key part of that.

Backline AI on LinkedIn · 5 Oct 2026

"It's AI until you trust it, and then it's automation", says Bartley Richardson , Chief AI Officer at CrowdStrike and a Backline advisor. He uses that line to describe how every security capability earns its way to autonomy. Detection and triage both made that crossing.

Strike48 on LinkedIn · 5 Oct 2026

Unauthorized use of AI tools can have the unintended consequence of exposing sensitive company information. It's a tricky problem for security teams to solve, because they can't monitor what they’re not aware of, but they don’t want to reprimand employees who are just trying to…

Cognna on LinkedIn · 5 Oct 2026

AI isn’t just helping attackers move faster. It’s changing how attacks are planned, executed, and scaled. Anthropic’s latest threat intelligence report documents cases that point to a broader shift in the economics of offense. But what does that actually mean for defenders?

Torq on LinkedIn · 4 Oct 2026

Tool count, headcount, capability checklists: none of it tells you if your team is making accurate, explainable decisions fast.

Elastic on LinkedIn · 2 Oct 2026

What happens when your AI model's guardrails block your own incident response? Jackie McGuire explains why model lock-in is a single point of failure for security teams.

Splunk on LinkedIn · 2 Oct 2026

Cheaper tokens don’t always mean a cheaper AI bill. As AI consumption grows, it’s time to move the budget conversation beyond token prices and toward what that spend is actually delivering.

7AI on LinkedIn · 2 Oct 2026

Anthropic's analysis of GLM-5.3 puts a date on something security teams have been planning for: a freely downloadable model that can develop exploits at frontier level, about four months behind the US frontier.

D3 Security on LinkedIn · 2 Oct 2026

FOUR HOURS IS AN ARCHITECTURE QUESTION DORA gives a financial entity four hours to file the initial notification on a significant ICT incident. Manual alert-to-classification runs 45 to 90 minutes on a good day, and the queue does not pause for the clock.

CrowdStrike on LinkedIn · 2 Oct 2026

This Cybersecurity Awareness Month, AI safety starts with recognizing a new reality: the rise of the Agent State. Introduced by George Kurtz at Fal.Con 2026, the Agent State marks a new era where AI puts nation-state capabilities within reach of eCrime actors, insiders, and…

Andesite on LinkedIn · 2 Oct 2026

Every AI SOC platform will eventually tell you it has “agents.” The more important question is: What can those agents actually do, and how can you evaluate them? Security teams should look beyond the number of agents or the sophistication of the demo.

Strike48 on LinkedIn · 2 Oct 2026

Day 2 of 31 highlighting security leaders: today is Ralph Hogaboom , CISO at the Washington State Department of Natural Resources. There’s a common misconception that LLMs create governance issues. Ralph proposes that LLMs merely expose existing problems that were normalized.

Bricklayer AI on LinkedIn · 2 Oct 2026

NVIDIA recently announced its Open Agent Safety Platform, bringing independent enforcement into the agent stack at the runtime and infrastructure level. We think there's an important opportunity to build on that approach.

Exabeam on LinkedIn · 2 Oct 2026

AI agents are changing the insider risk conversation and the market is taking notice. Enterprise Times ' Steve Brooks took a close look at our new research, The Agentic Insider: From Monitoring to Understanding, and highlighted one of its most important implications…

Secure.com on LinkedIn · 2 Oct 2026

In the cloud, the thing you need to investigate is often gone before you get to it. Containers and functions live for minutes, then disappear and take the evidence with them.

HarkX on LinkedIn · 2 Oct 2026

The conversation around autonomous security operations often focuses on what AI can automate. But the more important conversation is what organisations need to get right before autonomy can create lasting value. And that’s where successful enterprise adoption begins.

Exabeam on LinkedIn · 1 Oct 2026

Security analysts don't have a judgment problem. They have a time and volume problem. As environments fill with AI agents, automated workflows, and non-human identities, security teams need a new operating model.

Kai Security on LinkedIn · 1 Oct 2026

Our UK research puts the country ahead of the global average on machine-led security. But that still isn't enough to tip the scales. Nick Degnan , our Chief Revenue Officer, put the stakes plainly.

Andesite on LinkedIn · 1 Oct 2026

As AI takes on more work in the SOC, one question becomes increasingly important: Can you show how a decision was made? Auditability in human-AI security operations requires more than a record of the final answer.

Arctic Wolf on LinkedIn · 1 Oct 2026

If your organization is ready to close the gap AI has opened, learn more about Aurora Security Awareness and Training and get a demo today: https://bit.ly/46Uas4a AI is now the top cybersecurity concern among security leaders, cited by 35% of respondents, ahead of ransomware at…

Simbian on LinkedIn · 1 Oct 2026

The September Simbian newsletter is out. We put 27 models through an LLM security test. Three open-weight models beat Claude Opus 4.8, and none of the 27 passed. The full session is now on demand.

ServiceNow on LinkedIn · 1 Oct 2026

"What jobs can AI replace?" isn't the question that separates the leaders. The better one: What can people take on once AI handles part of the work? The answer shows up in which companies pull ahead, which jobs grow fastest, and which roles didn't exist a few years ago.

CrowdStrike on LinkedIn · 1 Oct 2026

Securing the future means preparing for a digital future that will look very different from the one we know today. AI is rapidly becoming foundational to how organizations operate, innovate, and compete. At the same time, AI is changing the speed and scale of the adversary.

Binalyze on LinkedIn · 1 Oct 2026

Forensic investigation used to be expensive. It depended on specialist time and manual collection, so it couldn't run as a routine managed service.

7AI on LinkedIn · 1 Oct 2026

Color pickers, ad blockers, and other everyday Chrome extensions have been quietly running attacker-controlled code inside employees' browsers.

Wirespeed on LinkedIn · 1 Oct 2026

Here's what we were up to in Q3. 📊 Reaching verdicts and automatically remediating in about 1200 milliseconds. Only escalating 2.5K events from 11.1M detections. 🤏 This noise reduction and speed is possible in your environment. Heck, we might even beat it.

Torq on LinkedIn · 1 Oct 2026

Our Field CISO John White has briefed a lot of boards on a lot of hard topics during his 20+ years as a CISO for enterprises like Virgin Atlantic, ASOS, Liberty Global, and KPMG. Here's his playbook for getting AI in the SOC across the finish line in the boardroom.

Arambh Labs on LinkedIn · 1 Oct 2026

Nobody has ever asked us how many agents we run. They ask what their team has to look at tomorrow morning. So that's the number we hold ourselves to. Armor OS works every alert to a verdict with the evidence attached, and about 10% need a human decision.

Rapid7 on LinkedIn · 1 Oct 2026

AI is changing more than the tools we use inside the SOC. It's redefining where people create value, which engineering skills our teams actually need, and how security operations should be measured as a whole.

Backline AI on LinkedIn · 1 Oct 2026

October's cybersecurity awareness theme is "Don't Make It Easy for Them." Good advice. Turn on MFA, slow down on the suspicious link, keep the phone updated. Now, run the same test on your enterprise.

Cognna on LinkedIn · 1 Oct 2026

Your Microsoft security stack can detect a lot, but detection is only one part of security operations. Someone still needs to monitor what matters, investigate suspicious activity, hunt for threats that evade automated detection, and respond when something happens.and now, two…

HawkEye on LinkedIn · 1 Oct 2026

One breach. 300,000 national ID records. A government's entire account server. The attacker didn't need a team for this. Just AI doing the reconnaissance, the phishing infrastructure, and the cleanup when its own malware got caught.

Kai Security on LinkedIn · 30 Sep 2026

52% of CISOs say they don't trust automated remediation. At the same time, 60% need more than a week to close a critical vulnerability. You see the problem there, too, right? Eran Livne , our VP of Product, hears "I'm not letting it push to production" almost every week.

Kai Security on LinkedIn · 30 Sep 2026

The AI jobs conversation usually starts with what people lose. Kai CEO Galina Antova wants to move the conversation to what security teams get back. 🚀 "Reaching zero is not the end of the story for a security team.

D3 Security on LinkedIn · 30 Sep 2026

BUSINESS TRIP OR BREACH An impossible-travel alert is a VPN exit node, a booked flight, a carrier’s geolocation being wrong, or an account takeover. The alert looks identical in all four cases.

Embed Security on LinkedIn · 30 Sep 2026

Building an AI SOC prototype has never been easier. Building one your analysts will trust at 2 a.m. on a Tuesday is a very different proposition. The build-vs.-buy conversation often focuses on what a system can do in a demo.

Kai Security on LinkedIn · 29 Sep 2026

Obvious failure is just that, obvious. That's exactly why it's easy to spot. 🔍 The problem is that if you point a language model at inconsistent scanner data, it will not fail obviously. Instead, it fails plausibly and then survives review.

Arambh Labs on LinkedIn · 29 Sep 2026

Every alert Armor Investigate closes teaches Armor Hunt where to look next. Every hunt that finds something hands Armor Detect a new rule to write. Every rule that ships sends Investigate a cleaner alert.

Elastic on LinkedIn · 29 Sep 2026

Social engineering used to force attackers to choose between reach and precision. AI now gives them both. The tactics haven’t changed... phishing, impersonation, and access compromise still dominate. Reconnaissance that once took roughly 40 hours now takes minutes.

Torq on LinkedIn · 29 Sep 2026

Your analyst marked it a false positive yesterday. Your AI triage flagged it again today. 🔁 Most AI SOC tools query, retrieve, and forget. Every alert treated like the first. Every verdict lost.

Tuskira on LinkedIn · 29 Sep 2026

AI usage is metered, budgeted, and committed the same way cloud was a decade ago. Enterprises are negotiating token commits. Some are writing token budgets into comp plans.

Andesite on LinkedIn · 29 Sep 2026

Every SOC has tribal knowledge. It lives in analysts’ instincts, investigation patterns, and understanding of the environment, often accumulated over years. The problem? Much of it never makes it into the system.

Bricklayer AI on LinkedIn · 29 Sep 2026

You added AI. The work queue didn’t get shorter. AI copilots have made analysts faster. That matters. But faster doesn't change who has to do the work. As providers add copilots and agents, tool sprawl risks becoming agent sprawl.

Secure.com on LinkedIn · 29 Sep 2026

For two decades, the severity score decided what security teams fixed first. This week, CISA effectively retired it. That's just one thread in this issue of The Secure Signal, alongside a new AI browser attack with no CVE to patch, our Head of Engineering in Dark Reading, and…

HawkEye on LinkedIn · 29 Sep 2026

Should AI be making escalation calls in your SOC? Our view: low-risk calls, maybe. Anything that disables accounts, blocks traffic or touches production needs an analyst. We looked at this through TypeSafe's Jev, one of the newer models built for these decisions.

Eventus Security on LinkedIn · 29 Sep 2026

AI risk is now entering the SOC's blind spot. Most SOCs were built to monitor servers, endpoints, networks and applications. But what happens when the risk sits inside the AI systems and automated decisions driving your business?

Kai Security on LinkedIn · 28 Sep 2026

📈 As of this September, 2026 has brought 2,600 Microsoft CVEs, more than double 2020's full-year record of 1,245, and the TrendAI Zero Day Initiative expects AI-assisted discovery to keep the number climbing.

Tuskira on LinkedIn · 28 Sep 2026

Tuskira Threat Brief: Week of September 28, 2026 Actively exploited edge infrastructure, AI-controlled malware, and modular persistence are making breach paths faster to establish and harder to remove. 1.

Andesite on LinkedIn · 28 Sep 2026

A SOC platform should do more than help junior analysts process tickets. It should help them become better analysts. The difference comes down to whether the technology simply tells an analyst what to do or helps them understand why.

D3 Security on LinkedIn · 28 Sep 2026

CERTIFIED WORKFLOWS DO NOT RETIRE The most common objection to modernizing a regulated SOC: years of certified playbooks, tuned, versioned, and audited. Nobody rebuilds that for fun.

Embed Security on LinkedIn · 28 Sep 2026

"No one can easily publish a dataset like this, but that doesn’t mean it can’t exist. It just means each vendor has to build their own and be judged on whether they did." It's very hard to compare accuracy claims across AI SOC products because of a lack of shared tests and…

Secure.com on LinkedIn · 28 Sep 2026

The account that leaks your data probably belongs to someone who did nothing wrong. They got phished, and now an attacker has all the access they earned. Insider risk isn't about catching bad people. It's about noticing good accounts doing unusual things.

Intezer on LinkedIn · 27 Sep 2026

"Potentially unwanted application" might be the most dangerous label in security. To most teams, PUA means nuisance. It lands in the low-severity queue and stays there. Our research team just published findings on a family we named NinjaMare.

SentinelOne on LinkedIn · 26 Sep 2026

🚨 This week, cybercrime hit international ransomware syndicates, developer supply chains, and online retail infrastructure. 🚦 The Good: A U.S.

Command Zero on LinkedIn · 25 Sep 2026

Over the last month we published five pieces on where the modern SOC is heading. They're pulled here into one quick read. The short version: once machines take the first pass, the analyst tier chart, the automation line, the tool debate, the analyst's job, and the scorecard all…

Wirespeed on LinkedIn · 25 Sep 2026

When threat actors use AI to execute attacks at machine speed, your defense has to be even faster. 🏃♀️ Tim MalcomVetter explains how the speed of Wirespeed Automated Detection & Response (ADR) is built to beat hackers in milliseconds. Learn more about ADR: https://bit.ly/3Tow0CA

Detections AI on LinkedIn · 25 Sep 2026

Threat actor delivery picked up the pace this week and cloud sourced execution chains continued to be a common theme for enterprise attacks. Four new CISA KEVs, a RAT that gave up on exploits entirely and an npm loader nobody asked for.

Arambh Labs on LinkedIn · 25 Sep 2026

Adding AI to a SOC isn't a tooling decision. It's an org design decision. The tiered model existed because triage needed bodies. It doesn't anymore.

7AI on LinkedIn · 25 Sep 2026

Outsourced security operations often leave your team doing the investigation, the coordination, and the deciding. The New Standard for Managed Security Operations lays out four standards a provider should meet: absorb the work, reduce the noise, progress toward action, and make…

Torq on LinkedIn · 25 Sep 2026

When Jev launched, we wanted to know whether a zero-shot classifier you point at a task with nothing but a prompt and a list of labels, could replace the model we've spent years training for alert triage. So our AI research team tested it on the open GUIDE dataset.

Conifers AI on LinkedIn · 25 Sep 2026

Our new research finds that most of what lands in the SOC queue comes from vendor detections the team can’t tune. So when one gets noisy, the choice is to suppress it and accept a blind spot, or let it keep firing until analysts learn to ignore it. There’s a third option.

HawkEye on LinkedIn · 25 Sep 2026

Attackers are not waiting for patch cycles to catch up. Week 39 tracks active exploitation affecting Check Point, F5 BIG-IP, Zyxel and Orkes Conductor, with several flaws creating paths to serious remote compromise.

VigilBase on LinkedIn · 25 Sep 2026

Thirty days after Cloudflare go-live, you should be able to show which customer journeys work and why each security adjustment was made. Build the evidence as you go. In week one, record the journeys you tested, their results and the issues still open.

Cylerian on LinkedIn · 24 Sep 2026

One alert: an inbox rule hiding mail on a Microsoft 365 mailbox. Around it, 412,847 events. Seventeen explained it. The rule was step six, not step one. Thirty-three minutes earlier, a phishing page had captured a session token.

Prophet Security on LinkedIn · 24 Sep 2026

An account gets compromised, so you suspend it. That's fairly straightforward... until the account belongs to your CEO. Or your identity system admin, where the playbook locks you out of the tool you need to fix things ☠️ So you build a group for the exceptions, and now it's…

Strike48 on LinkedIn · 24 Sep 2026

Not all “AI agents” are the same. The key is constructing workflows that are primarily deterministic, and then knowing when to insert agentic decision making. For security and IT that require precision, this is essential to success.

Bricklayer AI on LinkedIn · 24 Sep 2026

Raising four kids turns out to have some lessons for building autonomous AI. Adam Vincent, Bricklayer’s founder and father of four, recently started teaching his oldest daughter to drive. His realization?

Kai Security on LinkedIn · 24 Sep 2026

Nobody is going to ask the adversary to slow down too. ⏸️ Leaders at The Wall Street Journal Technology Council Summit took that as given and spent their time on the part they control.

D3 Security on LinkedIn · 24 Sep 2026

ONBOARDING IS THE GROWTH CEILING Most MDRs are not sales-constrained. The pipeline signs faster than delivery can onboard, because every new client means weeks of playbook building and integration wiring.

Andesite on LinkedIn · 24 Sep 2026

AI can move through security data remarkably quickly, but speed creates a new problem if the evidence behind an AI-generated conclusion becomes difficult to follow. For AI to be trusted in security operations, analysts need to understand: What did the AI see?

BlinkOps on LinkedIn · 24 Sep 2026

A more accurate reasoning model won't make your AI security agent production-ready. The model was never the weak point. When production agents fail, the model didn't get worse. The system around it wasn't strong enough.

Binalyze on LinkedIn · 24 Sep 2026

Detection tells you *something* happened. Investigation tells you **what actually happened**. That's the mindset we've been championing at Binalyze from day one, and we're pleased to see it explored in our latest feature with CIO Times.

Conifers AI on LinkedIn · 24 Sep 2026

Our new research, The Detection Blind Spot, spans 14,652 detections in live enterprise environments. In the average organization we assessed, 47% of detections need attention. Some won’t fire when the technique they target is used.

Secure.com on LinkedIn · 24 Sep 2026

Patch cadence looks great on a dashboard. But attackers check what's actually reachable from the outside. The Cloud Security Teammate maps exposure across every cloud you run, so "reachable" stops being a guess and starts being a list.

AISOC on LinkedIn · 24 Sep 2026

How many different platforms does your team need to access before they have the full picture? With security data spread across SIEMs, EDR platforms, cloud security tools, threat intelligence feeds, email security solutions, and ticketing systems, it's easy for critical…

Eventus Security on LinkedIn · 24 Sep 2026

Middle East Cyber Pulse | Issue #4 When the cloud goes dark, does your SOC still see? Cloud infrastructure disruptions in Bahrain and the UAE have brought a critical resilience question into focus: What happens to security operations when the infrastructure carrying workloads…

Exaforce on LinkedIn · 23 Sep 2026

Map Okta's "client.ipAddress" and Google Workspace's "ipAddress" to one "source_ip" column, and you get a shared field name. You still don't know whether the event was a login, a file access, or something that matters.

Kai Security on LinkedIn · 23 Sep 2026

AI agents should take the repetitive, predictable work. People should set the boundaries and make the calls that shape how security runs.

Arambh Labs on LinkedIn · 23 Sep 2026

A coverage map tells you a rule exists. It doesn't tell you the rule has never fired, the log source behind it died in March, or nobody has tested it against a real technique since it shipped.

Andesite on LinkedIn · 23 Sep 2026

A successful AI SOC pilot proves that AI can investigate a threat. A successful AI SOC deployment proves that it can do it reliably, repeatedly, and at scale.

AiStrike on LinkedIn · 23 Sep 2026

A detection rule and a hunting query can run against the same telemetry and still need very different architectures. Detection is continuous. The logic exists before the event arrives, holds state across a stream, and often needs an answer in seconds or milliseconds.

Secure.com on LinkedIn · 23 Sep 2026

Attackers do their homework before they ever attack. Most of what they dig up on you is stuff you left exposed without realizing it. Scan your exposure now → https://lnkd.in/e7xZtMJR

Qevlar on LinkedIn · 23 Sep 2026

Security teams have become very good at measuring detection volume: which rules fire most often, generate false positives, and consume the most analyst time. But volume only exposes one type of failure.

AISOC on LinkedIn · 23 Sep 2026

62% of security alerts go uninvestigated. The reality is that there are simply more alerts than there is time available to investigate them.

Qevlar on LinkedIn · 23 Sep 2026

Can you vibe-code your way to an AI SOC when you are a global enterprise? You can build a prototype surprisingly fast. But is it worth it?

Kai Security on LinkedIn · 23 Sep 2026

🆕 We asked 100 UK CISOs who currently holds the advantage. 59% said attackers. 13% said defenders. That's the headline finding in the UK edition of our 2026 State of Autonomous Defense Report, out now. The rest of the data explains the answer.

Alpha Level on LinkedIn · 22 Sep 2026

Our Co-Founders Mike Pozmantier and Joshua Neil wrote a white paper on Detecting Rogue AI. Key Takeaway: Agents are insiders. Monitoring them for unexpected behavior, the same behavioral approach long used against insider threats, is a vital complement to guardrails for catching…

7AI on LinkedIn · 22 Sep 2026

Defenders and adversaries got the same transformative technology at the same moment. That parity is narrowing faster than expected. In CSO Online, Lior Div revisits the Cyber AI Parity Window he described in April.

Simbian on LinkedIn · 22 Sep 2026

"Grok 4.7 should be roughly on par with Opus 5.0" - Elon Musk, Sep 14. Compared to Grok 4.6, it's a regression for cyber defense agentic threat hunting. 📉 Full story in the comments

Binalyze on LinkedIn · 22 Sep 2026

The evidence existed. But it was overlooked. The Revolut breach ran for months before anyone caught it. The trace was there — it just wasn't caught in time.

D3 Security on LinkedIn · 22 Sep 2026

THE EXAMINER READS ONE DOCUMENT Every framework that touches a financial SOC converges on the same request: show us the record of this incident. A multi-agent platform answers with a folder of per-agent logs and a stitching exercise.

Andesite on LinkedIn · 22 Sep 2026

Threat hunting has always depended on experienced analysts knowing where to look, and just as importantly, what to look for next. AI can change the economics of that process.

Tuskira on LinkedIn · 22 Sep 2026

You rub the lamp, make a wish, and the AI genie gives you exactly what you asked for. But somehow, it's the worst week of your year.

BlinkOps on LinkedIn · 22 Sep 2026

AI SOC is not a category. It's a feature. It went from a 2025 differentiator to a 2026 baseline that any vendor sitting on alert data can claim. Autonomous triage needs no write access, so it bolts onto almost anything. That is the definition of a feature, not a moat.

Bricklayer AI on LinkedIn · 22 Sep 2026

What happens when operational capacity is no longer the constraint? The agentic SOC is more than a new way to automate security work. AI agents take on operational work at a scale that changes how security teams operate, coordinate, and govern that work.

WiseBee on LinkedIn · 22 Sep 2026

AI can now find 20+ zero-days for the price of a team lunch. The result? Security teams are drowning in a flood of incoming alerts.

Conifers AI on LinkedIn · 22 Sep 2026

AI will not just automate the SOC. It will create a new role: the Threat Operator. A Threat Operator is an AI-native security professional responsible for operationalizing business security risk into defensive operations. They do not primarily operate individual security tools.

Backline AI on LinkedIn · 22 Sep 2026

We're still in Q3, and 2026 has already beaten 2025. By early September, the NVD had logged 60,475 vulnerabilities, compared with 48,185 for all of 2025. With AI speeding up discovery, the curve isn't flattening.

AISOC on LinkedIn · 22 Sep 2026

A common misconception is that adding more security tools automatically improves security. In reality, more tools often mean more alerts, more dashboards, and more complexity.

Secure.com on LinkedIn · 22 Sep 2026

AI agents are becoming reliable players in our systems. But with that trust comes new vulnerabilities. Our latest article breaks down BragJack, how it bypasses traditional security controls, and what organizations can do to defend AI agents.👇

RedCarbon on LinkedIn · 22 Sep 2026

Every first call goes the same way. "So you're a detection platform?" No. "A SIEM?" No, keep yours. "A SOAR?" No. Nobody maintains the playbooks anyway. "A dashboard?" We'd rather not. We get it. "AI-powered" is on every vendor site, and half of them bolted it onto a 2014 SIEM.

Wirespeed on LinkedIn · 21 Sep 2026

AI-first security agents aren't exactly bad. But they're also not the best tool for security investigations for many reasons. Check out our write-up on where AI security agents fall short in the speed of getting a conclusive verdict and the cost of tokens versus prebuilt…

Simbian on LinkedIn · 21 Sep 2026

"Great call." "Agreed." "Closing as benign." Your AI SOC has become the most agreeable person in the building. The dashboard loves it. Attackers love it more.

Spectrum Security on LinkedIn · 21 Sep 2026

Ask a CISO what their MTTR is and you'll get a number. Ask what percentage of their detection rules are broken right now and you'll get a pause. Meanwhile, detection informs if MTTR means anything or not.

AiStrike on LinkedIn · 21 Sep 2026

Insider threat is an investigation problem, not just a detection problem. Ask an insider risk team two questions: How many anomalies did the platform produce last month? How many were investigated to a conclusion? The gap between those two numbers is the program.

Andesite on LinkedIn · 21 Sep 2026

“Unified” has become a popular word in security operations, but putting more capabilities behind one interface doesn’t necessarily create a unified SOC. When evaluating a unified SOC platform, security leaders should ask: Does it actually unify the investigation?

Qevlar on LinkedIn · 21 Sep 2026

There is no shortage of commentary on where AI is taking cybersecurity. But it is more useful to hear from the people actually building frontier models, running global security teams, and putting AI into production.

Secure.com on LinkedIn · 21 Sep 2026

"Insider threat" makes everyone picture intent. Most of the time, intent has nothing to do with it. The account acting like an insider usually belongs to someone who did nothing wrong.

Detections AI on LinkedIn · 19 Sep 2026

Multiple Chinese threat actors are chaining Chrome and Windows 0-days. Here's our top 5 reports of the week. Contributors had all five up on Intel Exchange with detections, while the writeups were still fresh.

Spectrum Security on LinkedIn · 18 Sep 2026

Across the detection estates we replayed for the Detection Debt Report, invalid syntax accounted for less than 1% of broken rules. Two thirds (67%) were pointed at the wrong index, table, or field.

Tuskira on LinkedIn · 18 Sep 2026

Ninety seconds from the public internet to customer data, with no credentials and no WAF alert. It takes three findings to get there, and all three are rated medium, so they sit in the backlog.

Wirespeed on LinkedIn · 18 Sep 2026

Threat actors are operating at machine speed. 🤖⚡ Minutes to hours long SLAs from your MDR provider can't keep up. Wirespeed Automated Detection & Response uses automation to identify threats in milliseconds and contain them.

D3 Security on LinkedIn · 18 Sep 2026

"HOW IN THE WORLD ARE WE GOING TO GET COMFORTABLE WITH AGENTIC WORKFLOWS?" A security leader asked us that. His team wasn't even comfortable with automated response yet. Fair. Nobody should leap from zero to hands-off.

Andesite on LinkedIn · 18 Sep 2026

Alert fatigue is often treated as a volume problem. But reducing the number of alerts doesn’t necessarily reduce the amount of work required to investigate them. The bigger question is: How much effort does it take to determine what actually matters?

Kai Security on LinkedIn · 17 Sep 2026

Every ranked list of vulnerabilities has a line drawn across it somewhere...And everything below that line is a bet that nobody will look. 🙈 The bet used to be reasonable.

Andesite on LinkedIn · 17 Sep 2026

More security telemetry doesn’t automatically mean better security. For many SOC teams, the challenge is not collecting more data. It’s making sure the right telemetry is connected, contextualized, and usable when an analyst needs it.

Kai Security on LinkedIn · 17 Sep 2026

Companies need to redesign their security workflows and enable teams to move at machine speed. That was Galina Antova's point at the WSJ Technology Council Summit this week: most Fortune 500 companies run 80 to 120 security tools, stitched into one patchwork, while attackers are…

Torq on LinkedIn · 17 Sep 2026

If you are a security leader who knows AI SOC is the right move but hasn't pulled the trigger yet, this one is for you. Torq EMEA Field CISO John White breaks down the real blockers sitting between agreement and action, and exactly what the smallest, lowest-risk first step looks…

Dropzone AI on LinkedIn · 17 Sep 2026

A privileged AWS role just logged in from a country it's never used. Watch Dropzone's AI SOC Analyst check identity, check behavior, and confirm what actually happened, with every step shown, not just the score. Take the tour: https://bit.ly/4rB9RxT

Sevii on LinkedIn · 17 Sep 2026

Have you planned for a cyber swarm attack? AI is accelerating. Attackers are scaling. And emerging AI agent swarms could take attack volume, speed, and complexity to an entirely new level. The question isn’t whether AI will slow down. It’s whether your cyber defense can keep up.

Cantina on LinkedIn · 17 Sep 2026

Microsoft had to release another update to fix some broken remote desktop features after their security patch. This is a type of problem we wanted to explore with AI-generated patches to see if vulnerabilities could be fixed while keeping existing features working.

Anvilogic on LinkedIn · 17 Sep 2026

SAP kept Splunk. Moved telemetry to Databricks. And ran detection across both. The result: 35% more MITRE coverage in one week and more than $1M in annual savings.

Backline AI on LinkedIn · 17 Sep 2026

Every vulnerability you haven't found yet has a price tag now. Pour enough compute into scanning your own code and the cost of finding the next flaw climbs. Push far enough and you reach economic zero, the point where discovery costs more than any attacker will pay to get in.

CounterShadow on LinkedIn · 17 Sep 2026

Our founder Jonathan Zulberg on why we built AMI CounterShadow. Security teams don't have a tooling problem. They have a time problem — and every tool added to fix it takes more of the thing that's already short. AMI works inside the stack a team already owns.

Priam Cyber AI on LinkedIn · 17 Sep 2026

Whether you run one SOC or fifty, the same two questions decide it. What the AI does when it is not sure. And where what it learns from you ends up. Neither answer looks good on a slide, which is why most demos skip both.

RedCarbon on LinkedIn · 17 Sep 2026

Maybe today we are truly exaggerating the complexity of our processes. The ancients teach us that great works are built through efficiency and clarity, which is why at RedCarbon we always strive to maintain a lean and straightforward approach.

Eventus Security on LinkedIn · 17 Sep 2026

GCC enterprises don’t necessarily need another security tool. Most organisations already have SIEM, EDR, firewalls, cloud security, identity platforms and threat intelligence feeds. The bigger challenge is turning those investments into better security outcomes.

Mate Security on LinkedIn · 16 Sep 2026

Mate Investigates 🕵️ A real case study from Mate: An AI agent was investigating a stolen credential when it hit a wall. The evidence that would explain how the theft happened simply didn't exist in the logs.

Prophet Security on LinkedIn · 16 Sep 2026

When Prophet AI SOC Analyst investigated every alert in customer environments last fiscal quarter, there were a few aggregate findings our security operations team felt were worth bubbling up.

Nebulock on LinkedIn · 16 Sep 2026

Most threat hunting assumes an adversary on the other end. But some of the best hunts aren’t individuals or attack groups, but poor network hygiene that gives attackers easy paths to use for free if they get in. In our latest Hunt Mode, Senior Threat Hunter Brandon S.

Anvilogic on LinkedIn · 16 Sep 2026

Our CEO Karthik Kannan on why the SOC is going headless. For twenty years the console was the job: open the SIEM, click through alerts, pivot between tools. That's the layer coming apart now.

Backline AI on LinkedIn · 16 Sep 2026

Remediation had a naive era of ‘let’s fix everything’. Nobody could, so the industry got very good at sorting instead. Exploitability, reachability, blast radius, asset criticality. Sorting a pile still leaves the pile, and we've been saying so all along.

Secure.com on LinkedIn · 16 Sep 2026

In almost every security program, there's a dependency nobody likes to admit: it all rests on a person noticing something. This week put three cracks in that idea. Our new issue looks at what that means, and where security goes when the human never had a chance. 👇

Spharaka on LinkedIn · 16 Sep 2026

OT security doesn’t have a tool problem. It has a context problem. A typical OT environment can have network monitoring, IDS, SIEM, vulnerability management, asset discovery and compliance tools, all doing their individual jobs.

Eventus Security on LinkedIn · 16 Sep 2026

Your security tools may be working. But is your SOC working as one? Modern organisations rely on multiple layers of security — SIEM, EDR, threat intelligence, vulnerability management, and incident response.

Thought leadership

Get in touch