The SOC Of The Future… The Future Is Now
summary
Argues the SOC must be engineered for scale, complexity, and burnout with four focus dimensions: MITRE ATT&CK coverage, business constituency, IT surface (cloud, IoT, ICS) and telemetry effectiveness, not 100% one‑dimensional projects. Recommends commoditizing EDR, accepting multimodal detection, using BloodHound‑style graphs for breach paths, and running federated queries instead of a single data lake. Builds a human‑curated common operating picture, a cataloged data estate, standing containment/eviction SOPs, staffing for weekends, and cautious LLM use with QC before automation.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:06About the speaker and the future of SOCs
- 2:29Scale and focus in security
- 6:24Data access and correlation
- 8:34Detections and signals
- 10:23Graph thinking and breach paths
- 12:48Investigation rigor and context
- 16:02Containment and breach scenarios
- 17:48Workforce sustainability
- 19:15AI in security operations
- 27:42Q&A
related talks
41mOne SOC, The Whole SOC, and Nothing But The SOC, So Help Me
51mThe No BS SOC Story
53mSecurity Operations 2018: What Is Working? What Is Not.
32mConfidence in Chaos: Strategies for World-Class Security Operations
03mFighting Every Threat with AI Agents: The Future of Security Operations
40mCybersecurity Operations Center Technology Taxonomy
49mStories from the SOC Front Lines
33mThe Only Way to Survive Is to Automate Your SOC