AI Decision Intelligence
SOC Automation
Decision Control
Alert Triage
Autonomous Decision Making in the SOC: What It Actually Means
ArcannaJune 11, 20267 min read
Practitioner interviews
INSIDE ARCANNA
3 perspectives on why existing security stacks are breaking, and what trustworthy AI in operations actually requires.
-modified.jpeg)
Darius Iakabos
Technical Solution Architect
“SOAR was built for predictable workflows. SOC reality isn’t predictable.”
Why SOAR’s scaling ceiling isn’t compute — it’s the playbook maintenance burden — and what replaces it.
27 MINWatch
Alina Marcu, PhD
Chief Data Scientist
“AI without governance isn’t intelligence. It’s exposure.”
What a Trust Layer actually does — and why grounded decisions, drift control, and rollback are the price of putting AI in front of operations.
23 MINWatch
Denis Stefan
AI Engineer
“An agentic investigation works when the agent knows what it doesn’t know.”
How agentic investigations actually run end-to-end — structured outputs, decision-model guardrails, and verification at every step.
18 MINWatch
Keep Reading
Why SOAR Breaks at Scale, and What Actually Replaces It
The playbook maintenance ceiling, why headcount doesn’t fix it, and what the architecture looks like after SOAR.
ReadGoverning AI in the SOC: The Case for a Trust Layer
What a Trust Layer actually does — and why grounded decisions, drift control, and rollback are the price of putting AI in front of operations.
ReadInside an Agentic Investigation
Denis Stefan on how agentic workflows cut investigation time from 40 minutes to 2 minutes — and what guardrails make that safe.
ReadTrustworthy AI in the SOC
What makes AI trustworthy for security operations — and why confidence scores alone aren’t enough.
ReadTier-1 Analyst Burnout Isn’t a People Problem
High analyst turnover is a symptom of poor automation architecture. Here’s the design fix.
Read