Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Security Incident and Event Management.

AI SOC vs. white box AI: Why black boxes fail in the real world

There’s a growing wave of “AI SOC” startups promising autonomous everything. They’ll triage your alerts, investigate threats, and even run your playbooks. Push a button, let the machine handle the mess, and enjoy the magic. It sounds great until the moment something breaks. Then everyone, not just security, asks the same question: “What exactly did it do?” And that’s when these systems turn into a liability.

Turn security signals into structured investigations with Case Management in Datadog Cloud SIEM

Security operations teams manage a high volume of signals, often across multiple tools. Analysts may triage detections in one system, document progress in another, and coordinate remediation elsewhere. As context becomes fragmented, response times slow and the risk of missed threats increases.

Logs & Lattes: Episode 6 - How Small SOC Teams Stop Drowning in Alerts

Lean security teams don't need a smaller version of an enterprise SOC. They need a different approach entirely. Graylog Director of Product Management, Rich Murphy, joins Logs and Lattes to explain why 2-to-4-person security teams are the most underserved segment in cybersecurity and what needs to change.

Why Most Incident Response Retainers Fail When It Matters Most

Many companies have an incident response retainer...but it doesn't actually make them risk ready. That's because too many retainers are built on outdated, hour-based "use it or lose it" models that don't actually reduce risk, improve resilience, or focus on outcomes. A modern retainer should drive preparedness, align with today's insurance realities, and actively lower exposure before an incident happens.

How to secure cloud workloads without building a full-scale SOC

You don’t need a 20-person SOC to protect your cloud-native environment. What you need is the right strategy: map your risk, embed security early, automate detection, and let smart tooling do the heavy lifting. Here’s how security and DevOps leaders with limited resources can achieve enterprise-level protection without enterprise-level headcount.

The Metric AI Security is Missing

As autonomous and semi-autonomous AI systems take on more responsibility within the enterprise, they shift from being “features” of software to becoming true internal actors. They make decisions, take actions, call tools, orchestrate workflows, and influence other AI agents. With this evolution, we must confront an uncomfortable truth: the metrics and response patterns we built for deterministic software no longer work.

Whole-of-state cyber defense: How AI-driven security helps US states protect what matters most

Short answer: Because attackers exploit fragmentation faster than governments can respond This shift toward collective cyber defense is a cornerstone of the new federal vision. The March 2026 National Cyber Strategy for America explicitly calls for a "new level of relationship between the public and private sectors" and demands "unprecedented coordination across government" to protect the American people.