Security operations center (SOC)

The function that watches a running estate for attacks: alerts arrive from endpoint, identity, network and cloud sensors, someone or something decides which matter, and the survivors become investigations. The detect-and-respond layer of defensive-security.

The volume problem is the whole problem

soc-fast-slow-thinking puts numbers on it: across 25 million enterprise alerts, ~98% were resolvable without a human, leaving under 2% that warranted review. An organization taking 450,000 alerts a year is told to expect about 54 real threats buried in low-severity noise. Those figures come from a vendor, so treat the exact ratios as marketing — but the shape is not in dispute anywhere in the industry, and it explains why triage automation is the field’s central product category rather than a convenience.

The fast/slow split

The piece borrows Kahneman: a System-1 “fast brain” that investigates every alert autonomously — memory scans, file analysis, cross-signal correlation, verdict in under two minutes — and a System-2 “slow brain” where analysts, assisted by LLM copilots, take the escalated ~2% along with the work that was never triage in the first place: detection-rule engineering, threat hunting, incident reporting, complex cases. The claim it’s really making is about assignment: most SOCs put humans on System-1 work, which burns analysts out and misses things, while the genuinely deliberative work goes undone.

Note what the framing does to the copilot question. Copilots aren’t proposed for triage at all — they’re for the human lane. That’s a narrower and more defensible claim than most agentic-security marketing, and it cross-links to the agent machinery in ../agentic-tooling-wiki without needing any of its autonomy claims to hold.

The knowledge-layer argument

The piece’s sharpest point, and the one with a commercial motive attached: organizations that outsource investigation to an MDR provider don’t own the artifacts investigation produces — detection rules, case history, triage logic. Without that corpus, an analyst copilot has nothing organization-specific to reason over, so the outsourcing decision quietly forecloses the AI-assistance strategy years later. Self-serving (the author’s firm sells the in-house layer) and structurally plausible; nothing in the corpus tests it.

The layer below the verdict (SOAR, added 2026-08-04)

Deciding an alert matters is only half the loop; something then has to act across the tools the estate already runs. That layer has a name and now a page — SOAR — and the corpus holds two opposed implementations of it. shuffle is a deterministic workflow an operator draws by hand, inspectable before it runs. The System-1 fast brain above is a model verdict, adaptive and opaque. Both automate the same 98%; they differ in where the judgement lives — design time or run time.

Worth keeping distinct from the triage question this page is mostly about, because the risk profile inverts. A wrong triage decision loses an incident. A wrong response action isolates a production host or revokes a live credential, at machine speed, repeatedly.

Where this sits against SRE

A SOC and an SRE org both triage alerts over telemetry, and the resemblance is close enough to be worth naming: ../platform-ops-wiki owns the reliability version — observability, aiops, incident response for systems that broke on their own. The difference is an adversary. Reliability alerts don’t adapt to your response; an attacker does, which is why detection engineering is a continuing arms race and capacity planning isn’t.

soc-fast-slow-thinking · defensive-security · system-hardening · intezer