Most SOCs today are still built around the same assumption: wait for an alert, investigate it, move to the next one.But what happens when AI becomes capable of doing much more than alert triage?In this episode, Ahmed Achchak (CEO & Co-founder of Qevlar AI) sits down with Rob van Os, Strategic SOC Advisor at SOC-CMM, to discuss what comes after the alert-centric SOC and why the future of security operations may be driven by continuous situational awareness rather than reactive investigations.You'll discover:→ The three stages of SOC evolution: human-led, AI-augmented, and AI-driven.→ Why simply adding AI to existing workflows won't unlock its full potential.→ How exposure management, telemetry, and threat intelligence can be combined to create true situational awareness.→ Why the role of analysts will shift from investigation to governance and oversight.→ The biggest obstacles preventing organizations from building AI-driven SOCs today.→ Why trust, context, and human validation remain essential even as AI capabilities improve.Agenda:01:30 – The three stages of SOC evolution04:10 – Why the alert queue is becoming the SOC's biggest bottleneck05:15 – Moving from reactive investigations to continuous monitoring07:35 – Situational awareness: combining threats, exposure, and telemetry10:35 – Can AI help build self-healing security operations?13:00 – What trust looks like in an AI-driven SOC18:00 – The data and context problem29:00 – Fire Round: AI, SOC maturity, and future attacker tacticsFollow Ahmed on LinkedIn: https://www.linkedin.com/in/ahmed-achchak-872554109Follow Rob van Os on LinkedIn: https://www.linkedin.com/in/socadvisor/Read Rob’s article on AI-driven SOC: https://www.linkedin.com/pulse/ai-driven-soc-revisited-moving-beyond-alert-centric-security-van-os-jyjqe/

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related