Independent research on AI in security operations
Cutting edge research intwhat AI is actually changing in security operations, and where the claims run ahead of the evidence.
.png/:/cr=t:0%25,l:0%25,w:100%25,h:100%25/rs=w:1209,cg:true)
AI SOC tools and AI-enabled MDR services promise many of the same outcomes, but they solve different problems. This paper looks at where each model fits, when to use one or the other, and when a hybrid approach makes more sense. Sponsored by Daylight Security.
Marketing narratives can survive contradiction. Security operations cannot.
Oliver Rochford
Most vendors know what they have built. The harder questions are where it fits, why it matters, how it differs from the alternatives and whether buyers will understand the distinction.
Oliver Rochford, Cyber Futurists
Who we work with
Recent research
Security Operations at the Nexus of AI
AI SOC tools and AI-enabled MDR services promise many of the same outcomes, but they solve different problems. Sponsored by Daylight Security.
Security Telemetry Pipelines
Security data costs are forcing changes to SIEM architecture. This report examines the emerging security telemetry pipeline market, why organisations are separating collection and transformation from analytics, and what that means for the security stack. Sponsored by Auguria.
The 2025 SOCless Operating Model Report
AI analysts change more than Tier 1 triage. They change the economics and structure of the SOC itself. This research examines what a SOCless operating model looks like in practice, where AI agents fit and where people remain essential. Sponsored by Dropzone AI.
Hype Check: The State of AI in the SOC
A discussion with Augusto Barros on what AI is actually changing in security operations, where adoption remains limited and which vendor claims deserve more scrutiny. With Prophet Security.
Research to cut through a market full of claims
Cybersecurity has never lacked confident predictions. AI has only made the problem worse.
I research emerging security operations technologies from the buyer's side: what problem they solve, how they change the architecture or operating model, where they fit against existing products, and whether the evidence supports the claims being made for them. My current work focuses on AI in the SOC, security data architecture, detection and response, threat and vulnerability management, and the changing economics of security operations.
Sponsored research
Funded research. Not conclusions.
Vendors can sponsor papers from my published research agenda or commission work on a related topic. The sponsor is disclosed. I conduct the research and retain control of the findings and conclusions.
That independence is the point. A paper that simply repeats the sponsor's positioning is marketing. Independent research gives buyers an argument they can assess on its merits, and gives the sponsor something more useful than another white paper.
Advisory
For cybersecurity companies with a difficult market problem
Most vendors know what they have built. The harder questions are where it fits, why it matters, how it differs from the alternatives and whether buyers will understand the distinction.
I work with cybersecurity and AI companies on problems such as:
- product and market strategy
- category definition
- positioning and messaging
- competitive analysis
- research and market intelligence
- product roadmap input
- go-to-market strategy
Engagements range from focused projects to ongoing fractional advisory work.
Speaking
Clear arguments backed by evidence
I speak about AI in security operations, SIEM and security data architecture, changing SOC operating models, telemetry economics and emerging security technologies.
The talks are built around a clear argument and the evidence behind it. They are written for the audience, not pulled from a standard conference deck.
Keynotes, webinars, workshops and private executive briefings are available.
Curious AI Newsletter
AI news with a critical eye
I write regularly about AI and the research questions I am working on. The newsletter picks out the developments that matter, questions the claims around them, and looks at what the evidence actually supports.
About Oliver Rochford
I am an independent cybersecurity analyst and former Gartner Research Director.
I have spent more than twenty years working across security operations, SIEM, SOAR, XDR, vulnerability management and security strategy, including roles at Qualys, Verizon, HP, Tenable and Securonix. At Gartner I researched security operations technologies and contributed to Magic Quadrant research. I have also written for SecurityWeek, CSO Online and Dark Reading, contributed to several editions of Hacking for Dummies, and have been cited by media, academic researchers and organisations including the OECD.
Today my research focuses primarily on AI and the changing security operations model.
More about me
Contact Us
Want to talk?
For sponsored research, advisory work or speaking, the easiest starting point is a short call.
The Cyber Futurists
62 Victoria street, Glossop, SK13 8HY
Oliver Rochford Ltd. Company number: 14480528