Security Automation Archives

Select a term…

You Don’t Need New Budget For An Agentic SOC. You Need Your SOAR Renewal.

You don’t need new budget for an agentic SOC. You need your SOAR renewal. How to fund a modern SOAR and an agentic SOC from…
What Is Cost Per Alert? | D3 Security Glossary

Cost per alert is the unit cost of bringing one alert to a defensible disposition, read as a multiple of the analyst labor it displaces…
Keep ServiceNow, Kill the Meter, Own the Models

Keep ServiceNow for IT, drop the Now Assist usage meter, and run a SOC AI you can audit. The practical case for moving security operations…
How Do AI SOC and Agentic SOC Pricing Models Compare?

AI SOC and agentic SOC platforms are priced five ways: per investigation, per token, in credits, per endpoint, or as a subscription with 100% of…
The Story of an Alert, in 8 Stages You Can Prove

Investigating every alert at L2 depth is an engineering problem. Here is the 8-stage lifecycle behind it: autonomous at every stage, governed at every stage.
What a Governed Agentic SOC Does When It Can’t Be Sure

The most useful moment in an agentic SOC demo is the failure path, not the clean verdict. Here’s what to ask to see, and what…
What Is Command-Risk Tagging? | D3 Security Glossary

Command-risk tagging ships the approval requirement with each integration action as risk metadata, so the approval gate sets itself per action instead of depending on…
What Is Effective Alert Risk? | D3 Security Glossary

Effective Alert Risk (EAR) is the environment-specific risk score a governed agentic SOC assigns each alert, opened to its factors, weights, and evidence so the…
100 Wrong Verdicts a Day: The Fine Print Inside a “99% Accurate” AI SOC

LLMs perform pattern completion over whatever context they’re given. Why AI triage reads missing evidence as benign, and the guardrail that prevents it.