Ask Our SOC Anything: What Your SOC Wishes You Knew

This session was Critical Start’s third Live SOC session, where Savannah answered questions submitted by registrants on how the SOC uses AI, tames alert fatigue, and works with customers. Savannah has spent more than five years in the Critical Start SOC, from security analyst to lead analyst to senior engineer, and now helps architect SOC AI and other agentic workflows.

Topics covered in this session:

• What the SOC wishes customers understood, and why customer context, rules of engagement, and feedback make investigations faster and deeper
• Why customers’ IT context, such as change requests, policies, and job functions, isn’t visible to the SOC, and how the “experts on threats, experts on your environment” partnership closes the gap
• How SOC AI speeds up OSINT and evidence gathering while human analysts validate every Tier 1 alert and make the final call
• How SOC AI accuracy is measured through thumbs up/down feedback, analyst overrides, and regular review of negative responses
• How adversary-in-the-middle and device code phishing slip past users, and the patterns that raise red flags for analysts
• How the Trusted Behavior Registry (TBR) filters known-good activity so analysts focus on what needs attention
• What “trust but verify” means when evidence is inconclusive, and what information customers can share to help the SOC protect their environment