Co-Founder & CTO, Simbian
I write first-principles explainers for security leaders navigating the shift to autonomous operations - no corporate speak, no fluff.
Why traditional SOCs are breaking down, and what autonomous security actually looks like.
First-principles thinking on how AI agents are reshaping security engineering from the ground up.
Lessons from building a security startup - technical decisions, leadership, and the messy middle.
The industry uses 'context' as a synonym for 'more data.' It's not. Here's a first-principles framework for what context actually means - from events to chains to storylines - and why most SOCs are stuck at Layer 1.
The greatest vulnerability in the modern SOC is not a lack of data - it is a lack of memory. How tribal knowledge, context lakes, and a new role called the Context Analyst change everything.
We treat the SOC as a defensive funnel, but functionally it's a bottleneck. When attack volume goes exponential, a fixed capacity model forces you to ignore the vast majority of signals to save the sanity of the team.