All posts
Topic
Soc
5 articles on soc.
SIEM vs SOAR: The Real Difference and When You Need Each (2026)
SIEM collects and correlates security logs to detect threats; SOAR automates the response with playbooks. How they differ, whether you need both, and where Splunk, XDR and MDR fit.
October 25, 2026
SOC-CMM & SOC Maturity Models Explained (2026): How to Assess Security Operations
A SOC maturity model like SOC-CMM measures how developed your security operations are — from ad hoc alert-chasing to proactive, automated and threat-informed. The dimensions to assess and how to improve.
September 26, 2026
Free Threat Intelligence APIs: What's Available and How to Use Them
Threat intelligence APIs provide programmatic access to indicators, reputation data and context about threats. What free options can do, where they fit, and how to use them well.
September 26, 2026
The High-Risk User Checklist: Signals That Flag a Risky Identity
A concrete SOC and IAM watch-list of the behaviours and attributes — impossible travel, MFA changes, privilege escalation, leaked credentials and more — that should raise a user's risk score, why each matters, and how to respond.
September 10, 2026
Deploying D2D Agentic Architecture in a Real Security Operations Team
Lessons from wiring up a D2D multi-agent system to a production SOC: the PagerDuty integration, the human review queue, what broke, and what surprised us.
July 13, 2026