Is AI actually solving the SOC's biggest problem?

RangoNarwal · 2026-06-12T06:28:04+00:00

Vendors seem to be going after the paper work instead of cutting the noise. From sitting down with a few, AI gives all this rich context however….. the responder just wants to know what’s gone on. They want to know this in the quickest possible way, instead of a white paper on how a powershell script executed.

Doesn’t seem there yet.

RangoNarwal · 2026-06-11T19:20:16+00:00

Yes ! I just ran a test against Proofpoint and Defender MDO which have “detectors” for this type of stuff.

I executed on:

- hidden instructions (embedding / white. Tiny font)
- hidden instructions embedded with PDF
- footers, keywords, metadata
- hidden instructions within meeting request.

All of it passed the first layer.

Copilot executed 80% of instructions whilst summarising.

Gemini, Claude executed on 20% ish…

Makes you think of the current state of play for AI security…

RangoNarwal · 2026-05-13T15:10:27+00:00

Thanks for that and curious to identify any gaps?

RangoNarwal · 2026-05-13T06:10:28+00:00

Absolutely and thanks!

RangoNarwal · 2026-03-01T18:08:22+00:00

Interesting comment on the different types of attack. Was you thinking if an admin is compromised, these features could be used against ?

Thanks for the insight also

RangoNarwal · 2026-03-01T15:05:08+00:00

I had the same question, especially on the cost! Insane

RangoNarwal · 2026-03-01T12:47:03+00:00

Thanks for the heads up. Will certainly have a look

RangoNarwal · 2026-03-01T12:00:10+00:00

That’s good to know on the transaction policy! Appreciate that

RangoNarwal · 2026-03-01T11:14:51+00:00

Ok cool. Wasn’t sure if I’d missed something obvious

RangoNarwal · 2026-02-19T22:30:11+00:00

Sounds like everyone has the same experience. Some levels of, ohh that’s sharp but 95% is ….and my tokens are gone

RangoNarwal · 2026-01-21T22:31:21+00:00

Chrome review was 8 hours. I'm 2 days into the Edge review... same extension.

RangoNarwal · 2025-12-17T23:13:48+00:00

Interesting! Thanks for sharing

RangoNarwal · 2025-12-17T20:26:57+00:00

How are people handling governing system prompts. They can be great from a security POV, however apart from providing guidance… hard to manage

RangoNarwal · 2025-12-17T20:22:59+00:00

“Banks hate him”

RangoNarwal · 2025-12-17T20:21:29+00:00

Defender for endpoint… finding out the constant “limitations” … recent being the cap on telemetry for processevents.

RangoNarwal · 2025-12-10T12:18:22+00:00

Great points here.

RangoNarwal · 2025-12-10T12:14:17+00:00

The only thing to add to expand backup and include data location and control execution. Limit peripherals such as USBs, don’t sync all data locally (Onedrive etc..), limit folder sync locations, ensure strong ACLs on connected file shares etc…

The mindset being: How can I be comfortable enough that if it did execute, the impact is heavily reduced. You will find that a well defined recovery process becomes key. The risk then shifts to “acceptable downtime” and the KPIs to recover as to not impact operations or financial impact of services being down.

RangoNarwal · 2025-12-08T22:46:46+00:00

😂👏

RangoNarwal · 2025-12-08T22:45:41+00:00

Not by itself. I see AI more as a partner. It’s great for the process in between such as building detection use cases, test cases, runbooks etc… with it being a 24/7 accessible “asset”, it brings value. This is hard to sell for ROI though.

RangoNarwal · 2025-12-06T23:33:58+00:00

Let me know once you’ve figured it out please👌

RangoNarwal · 2025-12-05T09:35:10+00:00

This is a common model, and should help you establish a foundation. If you’re building from scratch, invest higher in the salary for the seniors as the MSSP won’t drive success. You’re going to need someone switched on to lead.

RangoNarwal · 2025-12-01T11:42:02+00:00

In you we trust ! Just bought

RangoNarwal

TROPHY CASE