|
 |
SentinelOne’s Securing AI Bootcamp: Sept 29-30, Virtual Event. Earn CPEs. Zero Cost.
 |
Join thousands of security practitioners in this two-day bootcamp combining expert keynotes with hands-on technical workshops.
Featured Speaker: Corey Quinn, Chief Cloud Economist, Duckbill
Corey hosts the Screaming in the Cloud and AWS Morning Brief podcasts and writes Artificial Confidence, the AI expository newsletter your CTO forwards you. Corey’s keynote “Lies My Agent Told Me” walks through the lies practitioners get told (and tell themselves) and what’s left once you outgrow the suspension of disbelief.There is an odd thing happening to cybersecurity work. The threats are getting faster, the infrastructure is getting more complicated, and the number of things we are supposed to secure continues to grow. Yet, at the same time, a growing proportion of the actual work is becoming easier to perform. That does not necessarily mean security professionals will have less work, and anyone hoping that artificial intelligence would usher in the four-hour SOC shift is probably going to be disappointed.
What it does mean is that the contents of an ordinary working day are beginning to change. We can already see the beginnings of a security profession in which humans spend less time collecting information and more time deciding what should happen next. Some of that change is coming from generative AI, while some is the continuation of automation trends that have been developing for years. The interesting question is how far that transition goes.
The security operations centre has changed significantly over the past decade. The traditional SOC was built around a relatively simple model: collect security logs, generate alerts, investigate suspicious activity and escalate serious incidents. SIEM platforms provided the central source of information, while analysts used documented playbooks to investigate and respond.
That model is now being challenged from several directions. Organisations generate telemetry from cloud services, endpoints, identities, applications and networks, while attackers have more opportunities to automate reconnaissance, credential theft and exploitation. Artificial intelligence adds another variable. Attackers can use AI to produce code, adapt techniques and scale social engineering. Defenders can use it to analyse data, investigate incidents and automate response.
Over the next ten years, these changes are likely to produce a different type of SOC. The central question will not be which security product collects the most alerts. It will be how effectively an organisation can combine telemetry, detection engineering, automation and human judgement. The SOC of 2036 is likely to be less of an alert-processing operation and more of an adaptive security system.
Detection becomes software
The first major change will be in detection engineering. Traditional detection work often involves analysts writing queries for a particular SIEM and adapting them when the environment changes. This produces useful detections, but it can also create large collections of rules that are difficult to test and maintain.
Sigma provides a useful model for what comes next. Its vendor-neutral detection format allows rules to be shared across security platforms, while its ecosystem connects detections with threat hunting, ATT&CK techniques and security testing. Hayabusa provides another example. It processes Windows event logs into forensic timelines and supports the Sigma specification, allowing large volumes of Windows telemetry to be searched using portable detection logic.
Over the next decade, detections are likely to become increasingly similar to software. They will be version-controlled, tested against known activity, measured against attack simulations and automatically deployed. AI will assist with writing and modifying rules, but the important change will be the engineering process around those rules.
This also makes behavioural detection more important. Attackers using automated or AI-assisted tooling can change filenames, infrastructure and code rapidly. A detection based on a single indicator can become obsolete quickly. Detections based on behaviour, sequences and relationships should prove more durable.