Keynote | Blue Team | SOC of the Future…the Future Is Now

Keynote | Blue Team | SOC of the Future…the Future Is Now

by Carson Zimmerman

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Carson Zimmerman 👥 70K 📅 February 17, 2026 ⏱ 28 min 👁 317 📄 expert opinion 🧭 2026-08-15
Available in: English (current) Français

Keywords

SOCBlue TeamSecurity OperationsAutomationAI

Summary

In this keynote from the SANS Hack & Defend Summit 2025, Carson Zimmerman, Chief Architect at Microsoft’s SOC, shares his vision for the future of Security Operations Centers. He argues that the future is already here, just not evenly distributed, and that we should learn from current practices. He outlines eight key areas: scale and focus, data federation, multimodal detection, graph-based reasoning, investigation practices, containment and response automation, workforce sustainability, and the role of AI. He emphasizes measuring coverage across four dimensions (MITRE ATT&CK, business areas, IT types, effectiveness) and focusing on identity and cloud layers. He advocates for accepting federated data and using tools that enable cross-cluster joins. He stresses the importance of graph thinking to understand breach paths and create a common operating picture. He highlights the need for analysts to share queries, not just data, and to curate findings in structured repositories. He recommends automating containment and response at scale, and building dedicated teams for sustained operations. He warns against burnout and suggests dedicating 50% of SOC capacity to non-incident work. Finally, he discusses AI’s potential to augment human judgment, not replace it, and predicts a gradual ramp of automation rather than a big bang.

198 words

Critical Evaluation

Value of the Information & Strength of the Argument

The talk provides valuable, practical insights from a seasoned practitioner. The argumentation is solid, based on real-world experience and observations. The speaker challenges common assumptions, such as the idea of a single data schema or complete automation, and offers actionable advice. The use of quotes and analogies (e.g., Fight Club) makes the content engaging. However, some points could benefit from more concrete examples or data to strengthen the argument.

Scientific Rigor, Source Quality, Title Accuracy

The speaker references his own book ‘11 Strategies of a World-Class Cybersecurity Operations Center’ (available for free) and mentions the MITRE ATT&CK framework. He also alludes to tools like BloodHound and Red Seal, but does not provide specific citations. The title accurately reflects the content, which is forward-looking yet grounded in current practices. The talk is an opinion piece rather than a research presentation, so the rigor is appropriate for its format.

156 words

Title / Content Match

The title accurately reflects the content, which focuses on the future of Security Operations Centers (SOCs) and emphasizes that the future is already emerging.

Quality & Reliability

8/10

The speaker is a Chief Architect at Microsoft's SOC with over 20 years of experience, and the talk is grounded in practical experience and references to established frameworks like MITRE ATT&CK. However, it is an opinion-based keynote without formal citations or peer-reviewed sources.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • 11 Strategies of a World-Class Cybersecurity Operations Center — The speaker's book, mentioned as free to download.
  • MITRE ATT&CK — Referenced as a framework for measuring coverage.

Concurring Sources

  • SANS Institute — The conference organizer, providing context for the talk.

Contribution & Novelties

The talk offers a pragmatic, experience-based perspective on the future of SOCs, emphasizing the need to adapt to federated data, multimodal detection, and human-AI collaboration. It challenges the hype around AI and automation, advocating for a gradual ramp rather than a big bang. The speaker’s emphasis on sharing queries and building common operating pictures is particularly insightful.

Pour aller plus loin :

  • MITRE ATT&CK — Framework for adversary tactics and techniques.
  • BloodHound — Tool for graph-based analysis of Active Directory attack paths.
  • Gartner Hype Cycle — Model for technology maturity, referenced in the talk.

94 words

Radar Profile

The radar profile shows high scores in information quantity and quality, with slightly lower scores in technical depth and reliability. This reflects a talk that is rich in practical insights but lacks formal citations and deep technical detail, consistent with an expert opinion keynote.

Reliability 7/10

💬 No comments were provided for analysis.