EP271 Can AI-Native MDR Actually Fix Your Broken SOC Workflows or Just Automate the Mess?

The podcast kicks off with a discussion on how AI native approaches are revolutionizing security operations centers (SOCs). The hosts emphasize that organizations still operating with legacy SIMs and manual workflows are at a disadvantage, but AI native solutions, which are built from the ground up for cloud environments, offer transformational potential. There is a strong critique of simply bolting AI onto legacy systems, comparing it to upgrading old applications with IP addresses, which doesn’t address fundamental architectural issues. The speakers advocate for building AI into modern, cloud-native security platforms that leverage structured data, context graphs, and designed-for-AI data structures.

A significant part of the conversation revolves around the metrics used to evaluate AI-powered SOCs. Traditional metrics like MTTR are becoming obsolete because AI enables near-instant detection and response. Instead, the focus should shift towards metrics such as reduction in false positives, false negatives, and attacker dwell time. The hosts highlight that their partnership has achieved alert triage times of under 48 seconds across 100% of alerts, effectively moving toward real-time detection. They stress the importance of measuring actual security outcomes — like incident prevention and attack dwell time — over vanity metrics that no longer reflect true security improvements.

Trust in automated containment and response actions remains a core concern for CISOs. The guests discuss how establishing digital trust involves building a 'cognitive infrastructure' with clear risk tolerances and policies that delineate what AI can handle autonomously. They agree that trust is a gradual process that requires transparent, human-led oversight, especially for critical actions like containment. The importance of human accountability is underscored, with some organizations allowing CISOs to predefine what can be automated versus what requires human approval. The conversation also touches on the ongoing evolution of self-healing and self-defending SOCs, referencing past white papers and future aspirations for autonomous security systems.

An ongoing debate is examined concerning whether security architectures should layer and connect loosely coupled components (like data lakes and decoupled AI tools) or favor unified, integrated platforms. The hosts lean toward a hybrid approach that combines on-premises, edge, and cloud components, emphasizing data gravity as a practical reason for centralized data processing. They acknowledge that some telemetry data can be effectively handled at the edge, with critical signals fed into a central, security-focused platform for analysis and response. The consensus is that the future lies in a flexible, hybrid architecture that balances immediate response needs with comprehensive visibility.

The guests share practical advice for security professionals embracing AI. One emphasizes that AI is still in its early stages and that practitioners should familiarize themselves with how AI can enhance their understanding, asking AI tools to teach and guide them. A recommended resource is the 'We Hack Health' community, which promotes health and well-being for security professionals under constant attack stress. The other highlights the importance of focusing on outcomes and engaging experts to develop effective, sustainable AI-driven security use cases. The discussion closes with a humorous note on how AI is being used personally, like automating social media content, illustrating AI’s growing role both professionally and in everyday life.