Blog
Field notes for SOC teams.
Investigation practice, architecture and evaluation guidance.
Running a SOC as a managed service on a multi-tenant platform
For an MSSP, every new client adds another boundary to defend. What the platform must enforce, what the provider owns, and the questions to settle before onboarding the next client.
BlogOT visibility without agents on controllers
You cannot install agents on PLCs, and auditors still ask about zones, remote access and controller changes. Start from the network data you already collect.
BlogSix hours: preparing your SOC for CERT-In reporting and DPDP breach duties
CERT-In's six-hour reporting window and the breach duties under India's DPDP Act leave no time to assemble evidence after the fact. Here is what to have ready before the incident.
BlogUnparsed logs are evidence too: what to do with the lines no parser reads
Every SOC has sources that do not parse cleanly. Dropping those lines hides evidence. Keep them, measure them, and turn them into parsers with a quality bar.
BlogGoverning AI in the SOC: six questions to settle first
Before a model reads your security data, decide where it runs, what it may see, what it may do, how it is limited, how you stop it and how you will know what happened.
BlogEvery security decision should be explainable
A SOC decision is only as defensible as the trail behind it. Three conditions make that trail hold up when the auditor, the board or the regulator asks.
BlogHow to evaluate a SOC platform with your own evidence
Vendor benchmarks measure the vendor's data. Agree your criteria first, record how your team works today, then run the same use cases on your own sources.