Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Before you replace your SIEM: AI-driven security requires operational context, not just centralized data

Artificial intelligence is rapidly reshaping how security operations centers (SOCs) function. Many organizations are now evaluating AI-native architectures to reduce workload and accelerate investigations. A new architectural narrative is emerging. A growing set of AI-native security vendors are proposing centralizing telemetry in a warehouse and deploying AI agents to replace the operational role of the SIEM. They want to centralize telemetry, apply AI, and automate the SOC.

Threat Intel Options with Sumo Logic -- Customer Brown Bag -- May 21st, 2026

Join us as Senior Technical Account Specialist Trent Driesler walks through Sumo Logic’s threat intelligence capabilities, including built-in feeds from providers like Intel 471 and CrowdStrike, and how to ingest custom indicators using collectors and APIs.

Ep 43: Who's got your data? Spoiler: Not you

In this episode of Masters of Data, we untangle the often-confused cousins of data sovereignty and data residency, because where your data lives and who actually controls it are two very different conversations. We dig into the real-world headaches facing multinational companies, from incident response teams locked out of sovereign data zones to the bureaucratic gymnastics that ensue when compliance meets practicality.

The cybersecurity nightmare of modern healthcare IT

Healthcare organizations are a primary target for cyberattacks. Outdated legacy tech runs rampant, and ransomware attacks are shutting down hospitals, forcing them to revert to paper records and cancel non-emergency procedures. The ripple effects extend beyond the targeted facility, overwhelming neighboring hospitals, putting lives at risk.

AI SOC vs. white box AI: Why black boxes fail in the real world

There’s a growing wave of “AI SOC” startups promising autonomous everything. They’ll triage your alerts, investigate threats, and even run your playbooks. Push a button, let the machine handle the mess, and enjoy the magic. It sounds great until the moment something breaks. Then everyone, not just security, asks the same question: “What exactly did it do?” And that’s when these systems turn into a liability.

How to secure cloud workloads without building a full-scale SOC

You don’t need a 20-person SOC to protect your cloud-native environment. What you need is the right strategy: map your risk, embed security early, automate detection, and let smart tooling do the heavy lifting. Here’s how security and DevOps leaders with limited resources can achieve enterprise-level protection without enterprise-level headcount.

Ep 40: What to expect when you are expecting an audit

On this episode of Masters of Data, we brought back GRC expert Cassandra Mooseburger to pull back the curtain on audits, and spoiler: it is far less scary than the IRS knocking on your door. We break down what actually separates a certification from an attestation from a report, how to run a prep process that does not send your engineering team running for the hills, and why the social capital you build across the business is just as important as the evidence you collect. If you have ever wondered how compliance work translates into closed deals and customer trust, this one connects those dots.

Observability is security (We just pretended it wasn't)

For years, we’ve drawn this artificial line that equates observability with uptime, performance, and SRE dashboards, while security is about threats, alerts, SIEMs, and “bad things.” While that separation was always convenient, it was never real. The same logs that tell you your service is slow are the same ones that tell you it’s compromised. We just routed them to different teams, different tools, and different budgets, then acted surprised when neither side had the full picture.

Ep 39: This is your first ransomware attack, not ours

On this episode of Masters of Data, we sat down with Steven Manley, CTO of Druva, to get the unfiltered truth about ransomware: it's not a matter of if you'll be breached, but when, and bad actors are now launching hundreds of attacks at a surprisingly low cost. We dig into why attackers lurk undetected for 200-plus days, how AI is being weaponized for everything from eerily convincing voice phishing to secretly training your own AI systems against you, and why your most protected assets are rarely what gets hit first.