SOC

You may have noticed my posts to date have stayed away from AI. That has been deliberate. Not because I’m anti-AI, or some kind of sceptic. Quite the opposite, in my professional and personal life I have been an avid and early adopter. My concern has been the pace of change across the AI landscape, which continues to evolve exponentially. I’d like my posts to hold some longevity, so that between an idea forming and a post going live, the ground hasn’t materially shifted, and it isn’t embarrassing to look back on within the year. ...

“You’re not paid to think.” I’m sure this phrase will spark fond memories if you’re ex-military. It was a joke… or was it. I would hear this said as ‘banter’ after a baffling decision had come down the chain of command, from some lofty heights. Or traded as a knowing joke between people who knew better but didn’t dare say so. Sometimes it wasn’t a joke at all, but an excuse not to override an order they knew was sub-optimal or downright wrong, through fear of discipline… or simply because leadership was weak. ...

Keeping the status quo was a mistake. I was building a SOC, in-housing all the outsourced capabilities from a Managed Security Services Provider (MSSP), and I had been asked to provide some specific metrics for an internal governance board. The same metrics the MSSP had been reporting. I provided them without questioning whether they were still appropriate, or whether they’d be the right ones for us going forward. They were not. ...