You Asked. Wyatt Answered. Live SOC Session 1 Recap

Q&A recap from our first live SOC session | October 9, 2026

Thank you to everyone who joined our first live Security Operations Center (SOC) session and sent in questions ahead of time. Wyatt Quintero, VP of Security Operations, answered the questions below, which we grouped by theme and lightly edited for readability.

Detection and Triage

Q1When the evidence is incomplete, what gives an analyst enough confidence to close an alert? And when should uncertainty itself trigger an escalation?

Wyatt's starting point is to air on the side of caution. At CRITICALSTART®, the Trusted Behavior Registry® (TBR®) ingests events across an organization and sorts them into threats, context and expected business-as-usual activity. When something new appears, the surrounding event data shows how it differs from normal. That context drives priority and tells the team whether to escalate.

An analyst can close an alert with confidence when the context shows the activity is expected, and the team then updates the playbooks to match. If it does not line up with what previous engagements or the environment would predict, the team escalates it or picks up the phone for a quick yes or no. To make the call on uncertainty, analysts ask why the event is firing, what detected it, whether the context around the indicator is accurate and what the risk is to the organization.

Wyatt also noted that it is easier to send an alert and follow up with a call than to stay quiet on something that turns out to be a true positive.

Q2What makes an alert worth investigating, and how do you prioritize when hundreds or thousands come in?

We look at every vendor's severity across its integrations, which now include more than 30 direct integrations, plus more through the security information and event management (SIEM) system.

On top of that, we layer historical data, context from other organizations, and the specifics of how your environment is built. This is how millions of events are narrowed to a few hundred escalations in a year. When activity follows expected, predictable patterns, it stays quiet. When it deviates, the team treats it as a threat until it can be proven otherwise.

Q3How do you correlate alerts across network, endpoint and identity, and what do you consider when triaging them quickly?

Few organizations run every tool from a single vendor, so the first step is getting all alerts into one view. From there, we correlate in several ways:

• Known attributes across integrations and asset types, including devices, identity, email and network
• Aggregate detections, where several smaller events together trigger a higher-priority detection
• Manual correlation searches, such as asking what else a particular user has done across every product we ingest
• A correlation agent that queries those sources automatically and proposes related activity for the analyst or investigation agents to include in their write-up

A broader scope influences priority, response actions and any remediation across multiple tools. Our SOC, customer experience team and product engineers meet about twice a week to balance human involvement against automation.

Coverage and Content

Q4How does the SOC work with the customer to make sure there are no gaps in detection across all log sources ingested by the SIEM?

It starts with scoping. How the SIEM is deployed determines the coverage it gives you, and you do not know what you do not know. That is why we favor direct integrations, which pull security events from the source of truth and use either vendor detections or new ones we build. Where a SIEM is still needed, we work with you to decide which sources are security-focused and which provide context.

This conversation happens during onboarding and continues throughout the service. Our practitioners build reports that go beyond ingestion trends. They compare what you are sending against your internal architecture diagrams and known data sources, flag potential gaps and quantify whether a source should be brought in. Detection reports then map deployed content to the events it triggered, their priorities and the verdicts reached.

Wyatt and SOC leadership review escalation trends weekly, including top sources and false positive and true positive rates. That feeds into your dashboard and your customer experience team, whether that is your CSM or your TAM.

Q5How much of my coverage comes from vendor-native detections versus your own content? Who tunes it, and how often?

For standard direct integrations, about 90 percent of coverage comes from out-of-box vendor content. The remaining 10 percent or so comes from what we add: attributes specific to your environment, lessons from across other organizations (validated through our cyber research unit (CRU) lifecycle) and custom detections requested by you.

Our team handles tuning. Major vendors push new content every week, and our team prioritizes it, runs a risk analysis and uses automation built around our scoring to move faster. When a vendor detection does not perform as expected in production, we recreate and redeploy it to cover what the vendor intended.

Threats and Trends

Q6What is the most common high-volume alert with a relatively simple fix that organizations keep overlooking?

Identity. Users are the easiest way into an environment and attackers continue to target them. The tools that help protect identities and email are often not deployed as well as they could be. Wyatt suggests going back to foundations: what tools you have, how much of your user base they cover, and where your users sign in from.

Once expected IP ranges and locations are defined with your identity provider as the source of truth, a lot of noise from anomalous logins and unexpected VPN sign-ins goes away. If you are a U.S.-only workforce and someone signs in from the APAC region, the team can quickly work out whether they are on vacation and prioritize accordingly.

Q7How are you training your analysts to handle AI-generated threats?

Wyatt addressed this in two parts. The first is AI used to carry out attacks. Phishing used to give itself away with spelling mistakes and broken links. That barrier has dropped sharply. Over the last three years, a significant share of our investigations that rate high or critical and prove to be true positives have been tied to phishing and identity risk.

The second part is how AI is used inside your own environment. Many organizations now run two to four AI tools, some purchased for that purpose, and some added to software they already own. Our analysts look for what AI is doing in your environment and ask whether it is approved and expected. Letting us know when you deploy new tools helps us build a TBR playbook for that scope, so anything outside it is handled the way you want.

Q8How often do you see attacks linked to state actors, and is there a clear way to tell them apart from other malicious activity?

Across his time in security operations and at Critical Start, Wyatt can point to roughly half a dozen cases we could confidently tie to a state actor or advanced persistent threat (APT) group. That does not mean there were no others. The level of engagement, sophistication, and reach of an investigation plays a big part in whether attribution is possible.

A phishing campaign that hits many customers may trace back to a known group, but a group that used a technique last week is not necessarily behind it this week. So the more useful question is which technique is in play and what your risk posture looks like against it. Our research units, SOC and security engineering team share that quickly so we can threat hunt, push high-fidelity detections and tell customers where coverage stands.

Trend callout: North Korean actors using false employment to gain access have continued to increase over the past year.

Response and Team

Q9What is the biggest thing that slows the team down between detecting a threat and containing it?

Unclear rules of engagement. From day one, we work with each customer to define what action we are authorized to take if we see a given activity, along with the exceptions. Those rules should not be written in the middle of an incident. We build them into rules that our analysts and agents can follow, maintain and audit, and we can export reports for a postmortem or tabletop.

The difference matters. Isolating a host immediately because it is pre-approved is very different from spending five minutes trying to reach a contact at 2:00 in the morning. Five minutes can separate a contained threat from one that spreads. A few customers have a policy Wyatt summed up as "don't watch the house burn down": if we cannot reach anyone after calling everyone on the list, we take the action.

Q10What is your analyst turnover, and how do you keep my environment from being relearned every time someone leaves?

Critical Start has kept analyst retention close to 90 percent. Part of that comes from giving analysts a two to three-year roadmap as they start their careers, along with career paths beyond the SOC. Former SOC analysts now work on our product team, as TAMs and even in sales.

Even so, Wyatt said the bigger factor is capturing the knowledge of your environment in the platform, which is harder in practice than most people realize. Picture an analyst who escalates a high-priority alert and calls the customer with 30 minutes left in a shift. After the shift ends, the customer calls back and wants to start an all-hands incident call (a "war bridge"). Another analyst can step in within one to two minutes, because the alert context, investigation audit trail, organization attributes and rules of engagement are all recorded. They already know the scope and blast radius and can pick up where things left off.

Our investigation agents work the same way, with audited timelines showing when context was applied and where it came from. That trail also supports your annual or biannual compliance and regulatory reviews.