Vulnerabilities, AI and security.
Understand risks, examine AI use cases and improve security operations. Explore the available articles.
Read the analysis that matters to you.
A signed file in an alert: verify the signature and continue the investigation
Separate the collected file, Authenticode verification, trust and observed behavior when investigating a suspicious Windows executable.
SOC operationsPackage flagged as vulnerable: verify backported fixes
Connect the installed package to its vendor advisory to verify a backported fix, investigate scanner disagreement and preserve a properly scoped conclusion.
SOC operationsSOC webhooks: a valid signature does not prove a new event
Separate signatures, freshness, identity and processing outcomes so that a webhook retransmission does not trigger the same action twice.
SOC operationsSuspicious email: what SPF, DKIM and DMARC actually establish
Interpret suspicious-email authentication: trusted results, assessed domains, alignment and relays, without mistaking a technical pass for a safe message.
SOC operationsSOC URL enrichment: verify the destination actually contacted
An alert URL must not give an enrichment tool access to internal services. Verify destinations, redirects, credentials and evidence that blocked requests stayed blocked.
SOC operationsSuspicious systemd service: connect the change to actual execution
Investigate a new or modified systemd service by separating files on disk, loaded configuration, observed processes and the effects of response actions.
SOC operationsDetection exceptions: limit scope and verify alerts return
Treat a SOC exception as a verifiable change: establish its effect, minimise scope, test boundaries, set an end date and verify behaviour after removal.
SOC operationsSOC API exports: verify pagination before drawing conclusions
A successful request does not establish a complete export. Check pagination, accessible scope and recovery before concluding that an event is absent.
SOC operationsDuplicate logs: distinguish retransmission from repeated action
Before deduplicating logs, verify event identity, provenance and detection outcomes so that genuinely distinct actions remain visible and explainable.
SOC operationsExposed object storage: establish possible access and observed reads
Investigate object storage flagged as public: effective permissions, presigned URLs, logging coverage and evidenced reads before verifying containment.
SOC operationsClosing a SOC alert: verdict, action and verification are different states
A closed alert does not necessarily mean a resolved incident. Separate the security verdict, action outcome and case closure to keep decisions verifiable.
SOC operationsDocument withdrawn from a RAG assistant: verify access and remaining copies
Verify document withdrawal from a RAG assistant across indexed chunks, permissions, caches, conversations and tests using synthetic data.
SOC operationsPrivileged group addition: establish rights and actual use
Investigate Windows and Active Directory group additions: actor, member, nesting, tokens and observed access before targeted containment.
SOC operationsWindows Security log cleared: investigate event 1102
Separate log clearing, the recorded account and actual activity: preserve available copies, correlate the session and verify restored visibility.
SOC operationsNode.js security updates: verify the runtime actually deployed
After the 21 October Node.js fixes, distinguish declared versions, running processes, exposed services and static builds to verify the update.
SOC operationsSuspicious email forwarding: establish where messages actually went
Connect forwarding configuration, audit history and mail-flow evidence to investigate suspicious email forwarding and verify targeted containment.
SOC operationsSuspicious OAuth consent: investigate the application's access
Connect consent, service principals, permissions and observed activity to assess suspicious OAuth access and verify a targeted response.
SOC operationsAn SSH key was added: connect the change to actual access in a SOC investigation
Investigate an added SSH key through effective configuration, change provenance, observed logins and verified containment.
AI SOCAI SOC analyst: what to demand before you trust one
Hand an AI SOC analyst your tier 1 triage only if it shows what it ruled out, cites evidence you can check, drops its confidence score in the open, and keeps a human in the loop on every destructive action.
Alert fatigueAlert fatigue is an arithmetic problem, not a morale problem
Alert fatigue is three numbers — alerts arriving, minutes a real triage takes, analyst-hours in a week. Why hiring and tuning both lose to it, and the one term that brings the backlog down.
CyberdecisionThe SOC is a decision system. Most tools still treat it as a monitoring one.
'Cyberdecision' is not a dashboard word. A security operations centre exists to produce decisions, not alerts — a triaged case, a verdict with its evidence, a queue that says what to open first. Judge every tool in it on how it changes the next decision, whatever detection stack you already run.
DetectionThe MITRE ATT&CK coverage gap, and why your real number is lower than the dashboard says
Measured MITRE ATT&CK coverage sits far below what most teams report. What a coverage number counts, how a broken detection rule stays green, and how to audit yours.
MSSPWhat an MSSP SOC platform has to do that a single-organisation SIEM never will
A managed SOC platform owes you four things a single-organisation SIEM does not: a wall between the customers you serve, unattributable alerts held rather than guessed at, reporting under your brand, and a flat fee.
Open sourceOpen source SIEM: what it gives you, and what you still build yourself
An open source SIEM solves collection, storage and rule execution. Detection engineering, cross-source correlation, case lifecycle and reporting are yours to build.
PricingSIEM cost per gigabyte: why the unit makes your team argue for less visibility
SIEM cost is usually metered per gigabyte, so every new log source becomes a budget argument — and vendor lock-in is the fear underneath it. What a per-deployment unit changes, and what it honestly does not.
TriageAlert triage, step by step: the six stages and where the hours go
Alert triage in six steps: dedupe, group, scope, verdict, action, record. Where the hours really go, which steps a machine should own, and what needs a person.
VulnerabilitiesVulnerability prioritisation: rank by exploitability, not by severity score
Vulnerability prioritisation by CVSS alone puts the wrong work first. Rank the remediation backlog by known exploitation, ransomware use, reachability and business impact.
How it helpsHow Seculogik helps a small SOC do the work of a large one
Most fully staffed SOCs are two to ten people, and most run 24/7 anyway. Where the hours actually go — tier 1 triage, escalation, the shift handover, the backlog — and what Seculogik gives back.
Sovereign AIA self-hosted AI SOC analyst: running the model on your own hardware
A self-hosted AI SOC analyst that reasons on your own hardware, with no GPU and nothing leaving the box. How SIROC runs local by default, what redaction happens before any cloud call, and how to refuse cloud models outright.
From WazuhWe started with Wazuh. Here is the floor we built above it.
Why a free, open detection agent was the right place to start, what a detection agent was never meant to do, and how a source-agnostic decision layer turns Wazuh — or whatever stack you already run — into triaged cases with an owner, an escalation path and an explained verdict, without an ingest meter.
CorrelationWhy the correlation engine is our crown jewel
A correlation engine owes you four things — a case that explains itself, deduplication that absorbs a burst without losing an alert, a triage queue that ranks on what a case has become rather than on how it started, and, if you serve several customers, a wall between them that cannot be crossed. What each one means for your SOC, whatever detection stack you already run.
RegulationNIS2, DORA, CIR 2024/2690: what the law actually asks — and what your platform has to prove
Three European texts now name managed SOC providers as a regulated class in their own right, put a clock on incident classification for financial entities, and set out monitoring and logging duties in the language a verdict layer is built to evidence. The precise wording, the dates, and what is vendor folklore.