by Jesper Kråkhede, Sweden
Posted in Security Architecture on Jan 14th, 2026
We talk about self driving cars in levels. Level 0 is a human doing everything, level 5 is a car without a steering wheel. I think it is time we did the same for the SOC, because every vendor now claims to have an ‘autonomous SOC’ and the word has stopped meaning anything. Here is […]
Posted in Security Architecture, Technology on Dec 10th, 2025
This year I have written a lot about automation and AI. Let me end with the opposite question: what should never be automated? I don´t mean never in the absolute sense. Technology moves fast. But today, I would keep a human in the loop for a few things. Actions that can´t be undone. Deleting data, […]
Posted in Business, Security Architecture on Jan 29th, 2025
Following my post on automation, a business question: what does it cost to do everything by hand? Let´s do a simple calculation. Say your SOC handles 50 incidents a day. Each one takes an analyst on average 30 minutes of repetitive work: looking things up, isolating, resetting, documenting. That is 25 hours a day, every […]
Posted in Security Architecture, Technology on Jan 15th, 2025
Everyone is talking about AI this winter. Before we get there, let me say something unpopular: most organisations haven´t automated the things they could have automated years ago. Look at what a SOC analyst does in a typical incident. Check if the user really logged on from that country. Look up the reputation of a […]
Posted in Business, Security Architecture on Aug 21st, 2022
I have written about Zero Trust on this blog since 2019. For a long time, the honest answer to ‘how do we do it?’ was a lot of policies, processes and manual work, with technology that only partly helped. That has changed in the last couple of years, and I think management should know about […]