Cybersecurity Awareness Month, Wrapped | November 5, 2026
This October, we opened our Security Operations Center (SOC) for five live Q&A sessions. Wyatt Quintero, VP, Security Operations, Seth Thompson, Senior Manager, Security Operations, and Savannah Overly, Senior SOC Engineer, answered your questions, first one by one and then as a panel. On November 4, Randy Watkins, our CTO and Co-Founder, closed the series by addressing the biggest themes.
The questions changed every week, but Randy named the thread running through all of them: verifiability. Can you trust the AI? How do analysts decide? Who is accountable? The poll revealed that 55 percent of voters saw AI in the SOC as their top concern. Here are the six takeaways, and what to do about each one.
Every session landed on the same answer about AI: it gathers; a human decides. SOC AI pulls together and summarizes hundreds of data points at once. Open-source intelligence (OSINT) lookups that once took analysts 10 to 20 minutes are now automated, and many investigations that took 30 to 45 minutes now take under 20. Randy estimated the decrease in time to investigate at around 60 percent.
Speed is not the point of the trust conversation, though. SOC AI does not close Tier 1 alerts on its own. A human analyst investigates and validates each investigation, and a second person is involved in every response action. Randy’s poll showed why: 46 percent said a full audit trail would make them trust AI in the SOC, well ahead of human sign-off alone at 26 percent.
So the evidence is open to inspection. A scratchpad shows where each data point came from. Audited timelines show when context was applied. Every SOC AI message carries a thumbs up and thumbs down, analysts’ overrides are reviewed, and changes go in one at a time so accuracy drift can be measured. SOC AI also has no access to response tools. It can propose a response, but large actions go to a human. Randy’s cautionary example: a prospect’s fully autonomous platform spotted lateral movement, blocked PowerShell, and caused a wave of blue screens. For the architectural risks behind stories like that, see AI By Design.
Takeaway: Ask any SOC, ours included, to show you the evidence behind a verdict, not just a promise that a human is in the loop.
Wyatt explained in Session 1 how millions of events become a few hundred escalations in a year. Seth gave the daily version in Session 2: an environment that generates 10,000 to 12,000 events might produce about 10 alerts that reach an analyst. The engine is the Trusted Behavior Registry (TBR), a growing library of behavior that analysts have already judged benign, both across all customers and for a specific one. It has filtered about 99 percent of events for more than a decade.
.jpg)
Randy added the part that makes it trustworthy: every TBR entry came from a real alert a human investigated, and a peer reviewed the decision before it went live. Because it is a deterministic list, it does not hallucinate. Same data in, same decision out, and it keeps working if AI is slow or down. His advice for anyone building their own AI-driven SOC: build that deterministic library first.
The registry also shows its value when volume spikes. Wyatt said major vendors reclassify domains as malicious about quarterly, flooding teams with false positives. The TBR groups alerts by shared attributes and excludes only the specific attributes behind the detection, never a whole domain, because attackers use noisy moments to slip in.
Takeaway: Build a library of known-good behavior before adding AI on top. Fewer, better alerts are what make faster, more accurate decisions possible.
Savannah’s Session 3 answer on the biggest misconception: SOCs do not automatically know your change requests, IT policies, or who does what. As she put it, “we are, at the end of the day, the experts on the threats, and the customers help us out by being the experts on their environments.” When context is missing, the SOC takes a trust-but-verify approach, sending you the evidence and the specific gaps instead of closing the alert. Wyatt’s test in Session 1: if this were your own environment, would you want to know?
What helps most is simple: upcoming travel, vulnerability scanner IP ranges, approved tools, and the admins who are expected to run certain activity. Seth added the other half in Session 4. Tell your SOC who and what matters most, such as executives, admins, and domain controllers, because “I don’t know John Smith as your CEO from John Smith in HR.” And finish onboarding. Every log source or endpoint agent left unconfigured creates a gap.
Takeaway: Share known-good activity and your critical assets, and close the gaps from onboarding. Your SOC can only be as sharp as the context it has.
Wyatt said identity accounts for roughly 90 percent of the high and critical true-positive escalations with response actions each week. It is also the high-volume alert organizations most often overlook. AI has made it easier: phishing no longer gives itself away with spelling mistakes and broken links, and the barrier to becoming an attacker is lower. Our H1 2026 threat data points the same way, with stolen credentials and valid accounts as the common thread in the period’s biggest incidents.
Seth’s view is that AI hasn’t created a new kind of attacker. It has made the same patterns faster and wider, so defenders should watch behavior, not chase tools. Savannah gave the examples: adversary-in-the-middle (AiTM) phishing, where a fake sign-in page captures the session and then redirects to a real site, and device code phishing, where the sign-in page is genuine. The red flag is the combination of a suspicious email, a sign-in page, and an odd redirect. In one real case, our SOC escalated a low-severity alert and contained an AiTM attack in 17 minutes.
The fixes are foundational. Define where your users should sign in from, so a U.S.-only workforce signing in from the APAC region becomes a signal. Randy called phishing-resistant multifactor authentication (MFA) with conditional access “the most preventative security control you can put in place.” And tell your SOC when you deploy AI tools. Many organizations now run two to four, and Randy compared shadow AI to shadow IT: almost always benign, but worth approving on purpose.
Takeaway: Set the baseline for who signs in from where, use phishing-resistant MFA with conditional access, and keep your SOC informed about new AI tools.
When Wyatt was asked what slows a team down between detection and containment, his answer was unclear rules of engagement. Isolating a host immediately because it’s pre-approved is very different from spending five minutes finding someone at 2 a.m. Five minutes can be the difference between a contained threat and one that spreads. A few customers have a policy Wyatt summarized as “don’t watch the house burn down.” See what fast containment looks like in this Qilin ransomware case.
Randy shared how customers tend to set theirs. About 15 percent say act on anything malicious. About 80 percent keep some assets off-limits, such as servers or executive accounts, and allow action everywhere else. About 5 percent, usually newer customers building trust, want to be called first. Most move toward more pre-authorization over time.
Takeaway: Tier your assets, pre-authorize response actions by tier, and keep your on-call contacts current. Do it before you need it.
Seth said Critical Start keeps about 90 percent of its analysts, against the 50 to 60 percent churn he typically sees in SOCs. A clear path helps: analyst, senior analyst, principal analyst, with about 300 hours of training up front and promotions based on getting alerts right the first time 90 percent of the time over 90 days. Retention matters to you because the longer analysts stay, the better they know your environment.
But knowledge should not live only in people’s heads. Wyatt’s example: an analyst escalates an alert near the end of a shift, and when the customer calls back, another analyst spins up in one to two minutes because the alert context, audit trail, and rules of engagement are all in the platform. Randy also pointed to Pete Shoard’s Gartner session on staffing the SOC: the analyst’s job is shifting from investigating to validating, and 64 percent of surveyed organizations believe AI will always require human validation with strong governance.
Accountability is the last piece. Seth’s answer on what happens when the SOC gets a big call wrong: tell the customer quickly and plainly, fix the issue, run a gap analysis, and deliver a root cause analysis for a significant miss. The goal is not to assign blame. It is to close the gap.
Takeaway: Ask your SOC how it keeps knowledge when people change, and what it does when it is wrong.
Randy ended the series with six things that make any SOC faster:
AI brings speed. People bring judgment. The evidence trail lets you verify both.
Watch or read all five sessions: Session 1 with Wyatt (recap), Session 2 with Seth (recap), Session 3 with Savannah (recap), Session 4 with the full panel (recap), and Session 5 with Randy.
