https://seculogik.pages.dev/blog/ Essays on security operations as a decision system, for CISOs, SOC leads and MSSP founders. en https://seculogik.pages.dev/blog/vulnerability-prioritisation-exploitability/ https://seculogik.pages.dev/blog/vulnerability-prioritisation-exploitability/ Tue, 08 Sep 2026 09:00:00 GMT Vulnerabilities Vulnerability prioritisation by CVSS alone puts the wrong work first. Rank the remediation backlog by known exploitation, ransomware use, reachability and business impact. https://seculogik.pages.dev/blog/soc-alert-triage-process/ https://seculogik.pages.dev/blog/soc-alert-triage-process/ Tue, 08 Sep 2026 09:00:00 GMT Triage Alert triage in six steps: dedupe, group, scope, verdict, action, record. Where the hours really go, which steps a machine should own, and what needs a person. https://seculogik.pages.dev/blog/siem-cost-per-gigabyte/ https://seculogik.pages.dev/blog/siem-cost-per-gigabyte/ Tue, 08 Sep 2026 09:00:00 GMT Pricing SIEM cost is usually metered per gigabyte, so every new log source becomes a budget argument — and vendor lock-in is the fear underneath it. What a per-deployment unit changes, and what it honestly does not. https://seculogik.pages.dev/blog/open-source-siem-what-you-still-build/ https://seculogik.pages.dev/blog/open-source-siem-what-you-still-build/ Tue, 08 Sep 2026 09:00:00 GMT Open source An open source SIEM solves collection, storage and rule execution. Detection engineering, cross-source correlation, case lifecycle and reporting are yours to build. https://seculogik.pages.dev/blog/mssp-multi-tenant-soc-platform/ https://seculogik.pages.dev/blog/mssp-multi-tenant-soc-platform/ Tue, 08 Sep 2026 09:00:00 GMT MSSP A managed SOC platform owes you four things a single-organisation SIEM does not: a wall between the customers you serve, unattributable alerts held rather than guessed at, reporting under your brand, and a flat fee. https://seculogik.pages.dev/blog/mitre-attack-coverage-gap/ https://seculogik.pages.dev/blog/mitre-attack-coverage-gap/ Tue, 08 Sep 2026 09:00:00 GMT Detection Measured MITRE ATT&CK coverage sits far below what most teams report. What a coverage number counts, how a broken detection rule stays green, and how to audit yours. https://seculogik.pages.dev/blog/cyber-decision-center/ https://seculogik.pages.dev/blog/cyber-decision-center/ Tue, 08 Sep 2026 09:00:00 GMT Cyberdecision 'Cyberdecision' is not a dashboard word. A security operations centre exists to produce decisions, not alerts — a triaged case, a verdict with its evidence, a queue that says what to open first. Judge every tool in it on how it changes the next decision, whatever detection stack you already run. https://seculogik.pages.dev/blog/alert-fatigue-arithmetic/ https://seculogik.pages.dev/blog/alert-fatigue-arithmetic/ Tue, 08 Sep 2026 09:00:00 GMT Alert fatigue Alert fatigue is three numbers — alerts arriving, minutes a real triage takes, analyst-hours in a week. Why hiring and tuning both lose to it, and the one term that brings the backlog down. https://seculogik.pages.dev/blog/ai-soc-analyst-what-to-demand/ https://seculogik.pages.dev/blog/ai-soc-analyst-what-to-demand/ Tue, 08 Sep 2026 09:00:00 GMT AI SOC Hand an AI SOC analyst your tier 1 triage only if it shows what it ruled out, cites evidence you can check, drops its confidence score in the open, and keeps a human in the loop on every destructive action. https://seculogik.pages.dev/blog/how-seculogik-helps/ https://seculogik.pages.dev/blog/how-seculogik-helps/ Sun, 06 Sep 2026 09:00:00 GMT How it helps Most fully staffed SOCs are two to ten people, and most run 24/7 anyway. Where the hours actually go — tier 1 triage, escalation, the shift handover, the backlog — and what the Verdict Layer gives back. https://seculogik.pages.dev/blog/siroc-ai-analyst/ https://seculogik.pages.dev/blog/siroc-ai-analyst/ Fri, 04 Sep 2026 09:00:00 GMT Sovereign AI A self-hosted AI SOC analyst that reasons on your own hardware, with no GPU and nothing leaving the box. How SIROC runs local by default, what redaction happens before any cloud call, and how to refuse cloud models outright. https://seculogik.pages.dev/blog/wazuh-next-level/ https://seculogik.pages.dev/blog/wazuh-next-level/ Sun, 30 Aug 2026 09:00:00 GMT From Wazuh Why a free, open detection agent was the right place to start, what a detection agent was never meant to do, and how a source-agnostic decision layer turns Wazuh — or whatever stack you already run — into triaged cases with an owner, an escalation path and an explained verdict, without an ingest meter. https://seculogik.pages.dev/blog/correlation-crown-jewel/ https://seculogik.pages.dev/blog/correlation-crown-jewel/ Thu, 27 Aug 2026 09:00:00 GMT Correlation A correlation engine owes you four things — a case that explains itself, deduplication that absorbs a burst without losing an alert, a triage queue that ranks on what a case has become rather than on how it started, and, if you serve several customers, a wall between them that cannot be crossed. What each one means for your SOC, whatever detection stack you already run. https://seculogik.pages.dev/blog/nis2-dora-decision-center/ https://seculogik.pages.dev/blog/nis2-dora-decision-center/ Sat, 22 Aug 2026 09:00:00 GMT Regulation Three European texts now name managed SOC providers as a regulated class in their own right, put a clock on incident classification for financial entities, and set out monitoring and logging duties in the language a verdict layer is built to evidence. The precise wording, the dates, and what is vendor folklore.