This session was Critical Start’s fourth Live SOC session and the last live session of October, where a panel of SOC leaders answered questions submitted by registrants on how the SOC uses AI, handles alert spikes, and works with customers. The panel included Wyatt Quintero, VP of Security Operations, Savannah Overly, Senior SOC Engineer and AI Architect, and Seth Thompson, Senior Manager of Security Operations.
Topics covered in this session:
- Why AI-assisted investigations can drop from 30–45 minutes to under 20, and how analysts validate every step the AI takes
- How SOC AI and analyst disagreements are tracked through thumbs up/down feedback and turned into permanent tuning
- Which investigation tasks are automated, and why humans still make the decision and take the action
- The most common rules-of-engagement and onboarding mistakes, and what they cost in time
- How adversary-in-the-middle phishing works, and the identity, email, and endpoint posture that reduces the risk
- What breaks first when alert volume spikes 10X, and how the Trusted Behavior Registry keeps the noise manageable
- How Critical Start responded to the recent PHP vulnerability and informed customers in under 24 hours
