I publish research on AI and security operations, including sponsored papers for security vendors.
The work covers the products, markets and claims emerging around AI SOC,
security automation and AI-enabled security services.
Sponsors are named on the research. They do not approve the conclusions.
Both are being sold as ways to reduce the work involved in triage, investigation and response,
but they do it differently.
This paper compares the two models, the work each takes on,
and the circumstances in which buying one, the other, or both makes sense.
Sponsored by Daylight Security.
Why security data architecture is changing
Security teams are collecting more telemetry while SIEM economics are making it increasingly expensive to put all of it in the same platform.
This report examines the emerging security telemetry pipeline market and the architectural shift towards separating data collection, transformation, routing, storage and analytics.
Sponsored by Auguria
What AI analysts change about the SOC
AI agents are increasingly capable of carrying out parts of triage and investigation that once required human analysts.
The interesting question is not whether they eliminate the SOC. It is how they change the operating model.
This research looks at how organisations can structure security operations when AI performs a growing share of routine analytical work.
Sponsored by Dropzone AI
How European organisations are approaching continuous threat exposure management
Research into the adoption of continuous threat exposure management, the technologies involved and the organisational changes required to make it work.
What the AI SOC market says — and what practitioners report
AI SOC vendors make ambitious claims about automation, analyst replacement and autonomous security operations.
Practitioners are considerably more cautious.
This research examines the gap between the two and what it tells us about the current state of AI adoption in security operations.
A simple model for estimating the security budget available to a target customer based on company size and broader IT economics.
A view of the emerging AI security operations vendor landscape and the different problems vendors are trying to solve.
Research and working material on technologies and market categories developing around security operations.