Alert Triage
Decision Intelligence
SOC Operations
Predictable Alert Triage at Scale: Why SOC Consistency Beats Raw Automation
Alina Marcu, PhDJune 15, 20268 min read
Alina Marcu, PhDJune 15, 20268 min readChief Data Scientist at Arcanna
She earned her PhD in computer science with a research background in deep learning before joining Arcanna to lead the design of the decision models and agentic systems at the core of the platform. She is the technical author of how Arcanna grounds AI decisions in the team's own judgment.
Practitioner interviews
INSIDE ARCANNA
3 perspectives on why existing security stacks are breaking, and what trustworthy AI in operations actually requires.
-modified.jpeg)
Darius Iakabos
Technical Solution Architect
“SOAR was built for predictable workflows. SOC reality isn’t predictable.”
Why SOAR’s scaling ceiling isn’t compute — it’s the playbook maintenance burden — and what replaces it.
27 MINWatch
Alina Marcu, PhD
Chief Data Scientist
“AI without governance isn’t intelligence. It’s exposure.”
What a Trust Layer actually does — and why grounded decisions, drift control, and rollback are the price of putting AI in front of operations.
23 MINWatch
Denis Stefan
AI Engineer
“An agentic investigation works when the agent knows what it doesn’t know.”
How agentic investigations actually run end-to-end — structured outputs, decision-model guardrails, and verification at every step.
18 MINWatch
Keep Reading
What to Look for in AI SOC Platforms: Thresholds, Drift, and Control
The thresholds, drift checks, and rollback controls security leaders should demand before trusting AI triage.
ReadTrustworthy AI in the SOC
Why trust, not speed, is the real test for AI in security operations.
ReadFrom Pilot to Business Case: Evaluating AI Triage Tools
How to move an AI triage pilot into a defensible business case, with the metrics that matter.
ReadWhy SOAR Breaks at Scale, and What Actually Replaces It
SOAR scales with headcount, not coverage. What actually replaces brittle playbooks at volume.
ReadWhen Analysts Can't Keep Up With Low-Priority Alerts
What AI triage actually fixes when low-priority alerts pile up faster than the team can clear them.
Read