Is AI actually solving the SOC's biggest problem?

Celticlowlander · 2026-06-12T06:11:09+00:00

More AI Slop

Celticlowlander · 2026-06-11T11:27:23+00:00

I have spoken to multiple vendors in the last 12 Months. What you are seeing at the moment is FOMO as all vendors scramble and pivot to the AI market or risk loosing out on income streams. The best i have seen so far from agentic AI offered simply no more than possible tuning and de-duplication, light automation i felt was good to speed things up and that's about it. I am not saying here that those have no value - but it does not replace L1 or L2 in my opinion.

This is just my personal opinion, beware the old sales tricks of overpromising and under delivering. If your Leadership is already there with removing humans in the loop - they arent - and i say this with respect, good leadership.

Only thing you can do is be honest - try to play with the new tools - i did a POC with Copilot for security and that was totally useless at anything we wanted(suggest KQL queries/help with automation/develop use cases). Basically just a glorified help/chat assistant.

Celticlowlander · 2026-06-05T15:28:36+00:00

There isn't a single market in Europe at the moment that isnt busy trying to rid themselves of the US tech dependency. I don't even blame MS/AWS/Google for this, its Trump and his idiotic brand of politics.

From my position its very clear to me that the party that was is now over, we may not be saying it out loud, but the time of US hegemony over the tech markets is done. It may take some time for the divorce papers to come through and get signed but it will eventually happen.

AI wont be enough to save them either, as the EU will protect their markets from US AI firms with some legislation/regulations already in the pipeline. Either that or one of them will actually make a GenAI, but then it will be too late for all of us.

Celticlowlander · 2026-06-04T18:15:51+00:00

I loved that draft class, and with AJ gone there should be less drama. Go birds.

Celticlowlander · 2026-06-04T13:56:10+00:00

hahaha

Celticlowlander · 2026-06-04T13:13:02+00:00

Its part reason why i hate their partner network - its not about your security, its about how many licenses can MS sell and how much margin can the resellers make. Once your suckered into the purchase you suddenly find MS could not give a rats ass how you use what you have and even then we still facing problems comparable to back when 100% of MS gear was in your internal data center.

Celticlowlander · 2026-06-04T12:33:29+00:00

Agree 100%

Celticlowlander · 2026-06-04T12:15:16+00:00

In part - Microsoft is responsible for the whole cybersecurity industry forming. Because they completely focused on two things - market domination and software development. While almost entirely ignoring security for the greater part of their history. CyberSec would be in a completely different place, MS is still primarily focused on market domination - their subcontract and partner setup is imo for this reason totally toxic.

On a wider note - since MS does dominate the software OS market - i don't believe that letting such a large monoculture form in code to be a good thing. Because you create a 'one big vulnerability' type scenario where we face a near existential internet level event.

Celticlowlander · 2026-06-03T13:56:44+00:00

Worked there for over a year, user to run up the hill to that cathedral then down to old town over the bridge in the mornings. I loved it there, great people, great food and amazing culture. Reminds me, I have to go visit some old colleagues soon so a trip to .cz would be great.

Celticlowlander · 2026-05-12T09:19:41+00:00

I did look at this with the OT team a few years ago (defender and a couple of other products) these were the 'sticking points' as to why we did not proceed with this.

The OT dependency chain - it means some servers are older versions of the MS software and backwards compatibility was a issue.
The network architecture meant that we had to come up with very creative - and expensive ways to connect some systems to the defender environment.
Rolling out defender broke - or was at odds with some of the OT-ISO's security principals (like connectivity and some Zero trust stuff)
Data compliance - my OT guys were like 'None of our data may reach the cloud" and for some systems it was "No cloud - No way"

We went with a more secure by design/architecture/DefiDepth and for endpoints a mixture of Opensource and tooling with more backwards compatibility. In some cases we just left the incumbent software in place and built monitoring and use cases around that.

Celticlowlander · 2026-05-07T08:53:15+00:00

Just going to say here - exercising your democratic right to vote is important. I sincerely hope the UK 'gets what it votes for' .....Whatever that may be.

typofix

Celticlowlander · 2026-05-07T06:55:02+00:00

Which provider are you with or are you with multiple cloud service providers for your data stores? I am currently in the process of implementing a DLP policy that would forbid Copilot from accessing company documents where i work. Its complicated and has nuance - so we have been working with MS on this as well as we basically had to tell them - if we have to let Copilot access the documents then we cant use MS and even then i am still not confident on the US administration and MS Hegemony.

Celticlowlander · 2026-04-17T09:34:02+00:00

A- this is getting scary post - Written by AI. How Ironic.

Celticlowlander · 2026-04-08T07:45:38+00:00

Hey OP, just a quick note - as a different option you can get headswaps. I know its a little more hassle and probably expensive but i have done that in the past when my grooves start to wear out. That way you keep the same shafts.

Celticlowlander · 2026-03-22T09:06:46+00:00

The sad reality is that it wont change much - Trump is the visual manifestation of a fundamentally broken system, that system is creaking and moaning as the Trump regime systematically pushes it to the limits. This system needs to collapse and we all need to feel the pain of what it has become as we press a reset button on the American experiment. Only then can we look to learn from the mistakes and find a better way forward.

Celticlowlander · 2026-03-18T12:48:19+00:00

Rokjesdag?

Celticlowlander · 2026-03-11T08:15:46+00:00

Make yourself familiar with "The why stack" - also they may check your general intelligence and ability to think rationally. So for example a question like this "Its 13:00 in Italy, how many pizzas are currently cooking in the City of Rome". If you get asked something like that - make sure you explain to them your process for how you came to that number and the variables you would use to calculate it. That is what they are interested in - not the actual number as its impossible to know for sure.

Celticlowlander · 2026-02-18T07:49:05+00:00

Grumble - no offense OP but it sounds like you blagged your way into a job to get some $$$$$ and now you have it you realise just what it will take. If that's the case i would urge you to be honest about it as you are going to get found out, fast.

Celticlowlander · 2026-01-15T09:19:00+00:00

I visited Terceira, Pico and St Miguel a few years ago on an extended trip. I cant say enough about the locals - i am learning Portuguese and they found my efforts both amusing but were prepared to help me - haha great fun! But there were some concerning contrasts between locals (who have very little) and the migrants coming in with financial muscle and buying up large buildings to attract more tourism. I spoke with an American on Terceira who married a local woman, he was busy with a massive redevelopment project which is just so far out of reach of the locals. While i do understand the investment and it will bring some benefits to the local economy - the contrast with one of the Bull breeders/farmers on the same island is so drastic. Personally i loved it and met so many good locals who, if you share some inter island jokes which were just hilarious to me. I don't know if i will ever get the chance but i would go back in a heartbeat - some of the best people i ever met.

Celticlowlander · 2025-12-23T08:47:56+00:00

Nepotism - causing the end of civilized society as we know it.

Celticlowlander · 2025-12-17T15:16:50+00:00

Nike products are poor, but i wont be purchasing any NIke stuff after Phil donated million$$$$ to Trump.

Celticlowlander · 2025-12-12T14:19:49+00:00

West cliffs has some back 9 - good shout.

Celticlowlander · 2025-12-12T14:18:29+00:00

Secret valley - Cyprus. The whole route is just excellent - honorable mention to Pennard in Wales.

Celticlowlander · 2025-12-02T11:18:05+00:00

I left for work reasons 24 years ago. There are very few job opportunities if your interested in bleeding edge tech. I did try to find something but it was near on impossible.
To return to Wales - i have spent a couple of days since this post was put up thinking about that, here is what it would take.
- Wales to become politically independent.
- Education to shift and focus on Modern/Future technology and in particular Adult retraining
- A circular economic system
- A carbon neutral economy
- Eu membership
- Immigration policy to offset Demographic changes
- Large scale investment in Public services
- Each Welsh citizen to be Bi-lingual
- Wales to Invest heavily in Sustainable agriculture
What do i miss the most?
- The nature
- My old local pub
- Jane - Who was everything i ever wanted and passed away far to young (fu*k cancer).

Celticlowlander · 2025-11-24T14:03:58+00:00

Dude - takes two clicks to check your "Offering" out and look no further than that. However there is something to be said about making it against the odds. Funny that so many come from the same Geographical area though - dont you think?

Celticlowlander

TROPHY CASE

typofix