AI's Bitter Lesson for SOCs: Let Machines Be Machines
summary
Anthropic experiments show that letting models "cook" rather than rigidly imitating analyst workflows finds novel strategies and scales: a prototype investigation platform called Clue (Claude Links Useful Evidence) is built in just over three months using Claude, Cloud Code, MCP tools, a query tool, external memory and simple storage buckets, it generates triage reports and full investigation transcripts (demos finish in ~2.5 minutes), batches handle 100x low-confidence signals, and costs run about per-alert cost $0.20–$1.
AI-written summary · about
chapters (18)
- 0:00Introduction to talk
- 1:09Current state of SOCs
- 4:00The bitter lesson explained
- 6:30Applying bitter lesson to SOCs
- 8:55Tooling requirements for AI integration
- 10:18Leveraging coding assistants
- 13:52Tools and MCP servers
- 15:36External memory for models
- 17:45Building collaborative triage platform
- 19:32Introducing Clue system
- 22:27Prompt design and tools
- 24:17Investigation process details
- 26:48Verification and transparency
- 27:31Batch processing and meta analysis
- 29:41Investigative UI demo
- 33:08Future applications and goals
- 34:10Encouragement to experiment
- 35:13Q&A session
related talks
42mAI for security - friend or foe?
35mThe Fight for the Future of Artificial Intelligence
38mBuilding AI responsibly with a GRC strategy
50mAI IN SRE: HYPE VS REALITY IN 2026
26mBecoming AI engineers
47mThe Past as a Compass for Systems Engineers in the Age of AI
46mAI Agents Are Becoming Operating Systems: Lessons From OpenClaw
54mAI: Actual Intelligence