The SOC Of The Future… The Future Is Now

The SOC Of The Future… The Future Is Now

Speakers: Carson Zimmerman, Microsoft

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=imc6ZPg2alI

Overview

In his compelling FIRSTCON presentation, "The SOC Of The Future… The Future Is Now," Carson Zimmerman of Microsoft argues that the future of Security Operations Centers (SOCs) isn't a distant prophecy but an unfolding reality, already visible to those who "look sideways." Dispelling the common misconception that the future is solely about new technology, Zimmerman emphasizes a fundamental shift in thinking and strategy. His talk provides a pragmatic framework for evolving SOC capabilities, moving beyond traditional, often siloed approaches, to embrace a more integrated, resilient, and human-centric operational model.

The presentation dissects eight critical areas where SOCs must adapt to current and emerging threats, highlighting the need for a holistic perspective that spans technical controls, data management, human collaboration, and sustainable workforce practices. Zimmerman challenges conventional wisdom, advocating for commoditization where possible, strategic investment in high-impact areas like identity, and a profound re-evaluation of how data is accessed, analyzed, and acted upon. Crucially, he addresses the transformative, yet often misunderstood, role of Artificial Intelligence (AI) in augmenting human capabilities rather than replacing them, positioning AI as a powerful tool for efficiency and effectiveness when wielded thoughtfully and with robust quality control.

This talk is particularly pertinent for security leaders, SOC managers, and analysts grappling with the escalating complexity of cyber threats, persistent talent shortages, and the rapid pace of technological change. By providing actionable insights rooted in extensive experience, Zimmerman offers a roadmap for building a more adaptive and sustainable SOC, capable of navigating the contested battle space of modern enterprise security. His message resonates with the urgent need to move beyond reactive incident response to proactive, strategic defense, ensuring that the "future SOC" is not just technologically advanced but also operationally intelligent and resilient.

Background

▶ Watch: Introduction: The future is already here, just unevenly distributed (0:00)

The modern security operations landscape is characterized by an ever-increasing volume and sophistication of cyberattacks, coupled with an expanding and diverse IT footprint that spans cloud, on-premises, IoT, ICS, and SCADA environments. This complexity has historically led to several persistent challenges for SOCs. Traditional approaches often focused on collecting all data into a single Security Information and Event Management (SIEM) system, a strategy that, while ambitious, frequently struggled with scalability, cost, and the sheer impossibility of centralizing every relevant data source. Zimmerman, having been involved in security operations for "way too long" and a veteran of the "golden age of SIEM," acknowledges the allure of such centralized solutions, but ultimately deems them impractical for today's distributed reality.

Prior work, including Zimmerman's own book "10 Strategies" (now considered outdated by him) and his more recent collaboration "1 Strategies" with Katherine Ingred (available at miter.org), reflects a long-standing effort to define effective security operations. However, the rapid evolution of adversary tactics and enterprise architectures necessitates continuous re-evaluation. The problem persists because many SOCs continue to operate under outdated mental models, prioritizing technology acquisition over strategic thinking, and often failing to account for the human element—specifically, the pervasive issue of analyst burnout and the need for sustainable workflows. The common reliance on "lists" of indicators rather than "graphs" of attack paths, as well as the struggle to integrate disparate data sources and detection platforms, further exacerbates the challenge. The talk implicitly builds upon the foundation of frameworks like MITRE ATT&CK, acknowledging its value while cautioning against its misuse as a mere "bingo card" for compliance rather than a strategic tool for comprehensive defense. The underlying problem is that the future has already arrived in pockets of advanced organizations, but its benefits are not yet "evenly distributed," leaving many SOCs struggling with yesterday's solutions for today's problems.

Key Findings

▶ Watch: Give up on a single data lake; embrace federated query (6:40)

Carson Zimmerman's presentation outlines eight critical areas, or "pillars," that define the SOC of the future, emphasizing a shift in mindset rather than just technology:

1. Scale and Focus: SOCs must consider four dimensions of coverage (MITRE ATT&CK, business areas, IT types, and effectiveness/SNR) rather than striving for 100% coverage in a single dimension. Commoditization of capabilities like EDR is crucial to focus resources on true positives and high-impact areas, particularly the identity layer, where adversaries increasingly operate.
2. Data Access, Federation, and Correlation: The reality of multiple, distributed data lakes must be embraced. Successful analysts excel at distributed join and federated query across disparate datasets, rather than relying on a single, all-encompassing data lake.
3. Detections: Multimodal detection is essential, acknowledging that no single platform (SIEM, SOAR, EDR, XDR) can do it all. Investments should be adversary-driven, focusing on what attackers target, rather than being dictated by available data.
4. The Graph: Defenders must shift from thinking in "lists" to thinking in "graphs" or breach paths. Tools like BloodHound exemplify this approach. Human-curated graphs are vital for a common operating picture during major incidents, avoiding "dandelions and bug splats" generated by machines.
5. Investigation: Rigor and discipline are paramount. Analysts must distinguish between what they know, what they don't know, and what they think (Powell's quote). Sharing queries, not just data, ensures reproducibility. A machine-indexed data catalog is necessary to navigate tribal data estates. Investigation workflows should involve continuous human-machine collaboration in succession.
6. Containment and Response: A standing containment and eviction capability is required, moving beyond single-user actions to address major breach scenarios at scale. This involves building a library of SOPs, incorporating human-in-the-loop and circuit breakers, and rigorously verifying containment actions post-incident.
7. Evolution and Workforce Sustainability: Preventing burnout is critical. Staffing plans must account for weekends and major breaches, dedicating 50% of capacity to proactive improvements (SOPs, playbooks, dashboards, better detections). A culture of safety and accountability, not blame and shame, is essential for retrospectives.
8. AI (Artificial Intelligence): AI will not replace humans, but "those who use AI will replace those who don't." Its application extends beyond triage and investigation to tasks like code writing, SOP drafting, intel processing, detection metadata generation, and dynamic SOP lookups. Success factors include rapidly updating AI scaffolding (anything over six months is dated), prioritizing believability and quality control before automation, and balancing LLMs with traditional automation (e.g., Python) to optimize cost and reproducibility.

Technical Deep Dive

▶ Watch: Attackers think in graphs: establish a common operating picture (10:00)

The core of Zimmerman's vision for the SOC of the future lies in a series of paradigm shifts across technical and operational domains.

Starting with Scale and Focus, Zimmerman challenges the notion of achieving 100% coverage in any single dimension. Instead, he proposes a four-dimensional approach: the MITRE ATT&CK framework, specific business areas (or enterprise constituencies), IT types (cloud, non-cloud, traditional IT, IoT, ICS, SCADA, firmware to applications), and effectiveness (SNR). False negatives, he observes, often arise from neglecting one of these dimensions. His advice is to commoditize what can be (e.g., EDR for host logs) and strategically focus investments where adversaries are most active, specifically highlighting the identity layer as a current high-value target. This implies a shift from generic, broad-stroke monitoring to targeted, high-fidelity detection in critical areas.

The discussion then moves to Data Access, Federation, and Correlation, a fundamental challenge for most organizations. Acknowledging the impracticality of a single data lake, Zimmerman advocates for embracing a federated data estate. Successful analysts, he notes, are adept at distributed join and federated query, pulling relevant information from multiple data sources as needed for each incident. The ideal state progresses from "data doesn't exist" to "we're collecting and retaining it," but critically, SOCs must be comfortable operating with data across this entire spectrum, even if they don't fully own or collect it all. This necessitates advanced data access patterns and analytical skills.

For Detections, the concept of multimodal detection is paramount. No single SIEM, SOAR, EDR, or XDR platform can provide complete coverage. The strategy should be adversary-driven—identifying what attackers are targeting and then building detection capabilities, rather than starting with available data and trying to find threats. This often involves using data in place, leveraging data that still "belongs to someone else" due to time and cost constraints of centralizing everything.

The concept of The Graph is introduced through John Lambert's quote: "Defenders think in lists, attackers think in graphs. As long as this is true, attackers win." Zimmerman urges defenders to think in breach paths, using tools like BloodHound to map connections between applications, identities, service accounts, users, and groups. During major incidents, a human-curated graph serves as the common operating picture, providing clarity that machine-generated "dandelions and bug splats" cannot. This visual, relational understanding is crucial for effective incident response.

Investigation requires significant rigor. Zimmerman quotes Coen Pal: "Tell me what you know, tell me what you don't know, then tell me what you think." This discipline prevents confusion. Crucially, analysts must share their queries, not just spreadsheets, to ensure reproducibility and maintain context for digital artifacts. Given the tribal nature of data estates, a machine-indexed data catalog is essential to help analysts discover and understand relevant data sources. Workflows should be designed for human-machine collaboration in succession (machine-human-machine-human), where investigative tasks can be handed back and forth. Furthermore, machines should assist in curating results in near real-time to overcome the inefficiency of analysts sifting through disparate notes.

Containment and Response moves beyond basic blocking and tackling. Zimmerman calls for a standing containment and eviction capability to manage major breach scenarios at scale. This isn't just about isolating hosts or rotating passwords for single users but having a pre-defined catalog of options and SOPs for major enterprise assets. It requires human-in-the-loop decision-making with circuit breakers and, critically, automated verification of containment actions, as service owners cannot always be trusted to execute changes correctly or completely.

Workforce Sustainability directly impacts the technical efficacy of the SOC. Recognizing that "a bad system will beat a good person every time," Zimmerman stresses the need to prevent burnout. Staffing models must account for peak loads, including weekends and major breaches. A significant portion (50%) of analyst capacity should be dedicated to proactive improvements like refining SOPs, playbooks, dashboards, and detections, fostering a culture of continuous improvement rather than constant firefighting.

Finally, the talk delves into AI, a topic Zimmerman deliberately saves for last. He posits that "AI will not replace humans, but those who use AI will replace those who don't." While automation of triage and investigation is a starting point, AI's potential spans across all SOC personas and tasks: code writing, drafting SOPs (especially from recorded meetings), processing large intelligence reports (e.g., extracting three sub-techniques from a 50-page red team report in three minutes), generating detection logic and metadata, and providing dynamic SOP recommendations based on incident context. Key AI success factors include:

• Rapid iteration of scaffolding: AI models evolve so quickly that any scaffolding older than six months is likely outdated.
• Garbage in, garbage out: Data quality is paramount.
• Believability before automation: Prioritize quality control and evaluation over immediate automation.
• Prompt engineering: Tweak prompts and skills before scaling.
• Chained decision accuracy: Be wary of chaining multiple AI decisions, as an 80% accurate model quickly degrades (0.8^5 is significantly lower).
• Avoiding "AI-generated slop": Instruct LLMs to be brief and concise, preventing analysts from being overwhelmed by lengthy, uncurated AI outputs.
• Balanced approach: Integrate LLMs with traditional automation (e.g., Python) to optimize cost, reproducibility, and predictability, rather than throwing every problem at an LLM. This hybrid approach leverages AI for initial drafts and complex reasoning, while relying on traditional code for repetitive, deterministic tasks.

Demo / Proof of Concept

▶ Watch: AI won't replace humans, but those who use it will (18:50)

While Carson Zimmerman's talk did not feature a live demonstration or a specific proof of concept developed by him for the audience, he frequently referenced practical tools and methodologies that exemplify his points. For instance, when discussing the importance of "The Graph" and understanding breach paths, he explicitly recommended downloading and using a tool like BloodHound. BloodHound is a widely recognized open-source tool used by red and blue teams to visualize and identify complex attack paths in Active Directory environments. This suggestion serves as a functional demonstration of the "graph thinking" he advocates, allowing attendees to explore and implement the concept in their own environments. His emphasis on sharing queries rather than just data also implicitly points to a functional proof of concept in terms of reproducible investigation.

Defensive Implications

▶ Watch: Q&A: Using AI to train junior analysts effectively (28:00)

The implications of Zimmerman's talk for defenders are profound, advocating for a strategic re-architecture of SOC operations:

1. Strategic Resource Allocation: Defenders must move beyond generic, broad coverage to strategically focus their efforts. This means commoditizing readily available solutions (like EDR for host logs) to free up resources. Investments should be directed towards high-adversary-impact areas, with a particular emphasis on strengthening defenses at the identity layer, which is increasingly targeted.
2. Embrace Data Federation: Stop fighting the reality of distributed data. SOCs need to invest in tools and training that enable federated query and distributed join across multiple data lakes. This means building a machine-indexed data catalog to help analysts efficiently discover and leverage relevant data, regardless of its location or ownership.
3. Adversary-Driven Detections: Shift from a data-centric to an adversary-centric approach for detection development. Understand what adversaries are targeting in your specific environment and build multimodal detection capabilities around those threats, even if it means leveraging "data in place" that the SOC doesn't fully own.
4. Adopt Graph Thinking: Implement graph-based analysis to understand breach paths rather than relying on flat lists of alerts. Tools like BloodHound should be integrated into both red and blue team operations to visualize attack surfaces and identify critical choke points. During incidents, human-curated graphs should be the primary common operating picture.
5. Standardize Investigation Rigor: Enforce a high level of rigor in investigations, ensuring analysts distinguish between known facts, unknowns, and hypotheses. Crucially, foster a culture of sharing queries for reproducibility and context preservation, moving away from unstructured data sharing like spreadsheets.
6. Develop Standing Containment Capabilities: Build a standing, scalable containment and eviction capability for major breach scenarios, not just for individual incidents. This requires a pre-defined library of SOPs for key enterprise assets, incorporating human-in-the-loop decision-making with circuit breakers, and implementing automated verification to ensure containment actions are effectively executed.
7. Prioritize Workforce Sustainability: Recognize burnout as a systemic risk. Implement staffing models that account for peak loads (weekends, major incidents) and dedicate at least 50% of capacity to proactive improvements (SOPs, playbooks, dashboards, detection tuning). Foster a culture of safety and accountability in retrospectives to encourage learning over blame.
8. Strategic AI Integration: Integrate AI thoughtfully, focusing on augmentation over full automation. Start with applications that enhance efficiency across various SOC personas (e.g., drafting SOPs, summarizing intel, generating detection code) and prioritize believability and quality control before scaling. Continuously update AI scaffolding (every six months) and adopt a balanced approach that combines LLMs with traditional automation (e.g., Python) for optimal cost, reproducibility, and predictability. Avoid "AI-generated slop" by instructing LLMs to be concise.

Key Takeaways

• Shift from Technology-First to Thinking-First: The future of the SOC is less about new tech and more about evolving our strategic thinking and operational models.
• Focus Strategically, Commoditize Tactically: Don't aim for 100% coverage everywhere; instead, commoditize common capabilities like EDR and focus resources on high-impact areas like the identity layer, driven by adversary behavior.
• Embrace Federated Data and Multimodal Detections: Accept that data will be distributed. Develop skills in federated queries and leverage diverse detection platforms, understanding no single tool can do it all.
• Think in Graphs, Not Lists: Adopt graph-based analysis to understand breach paths and attack surfaces, using human-curated graphs as the common operating picture during major incidents.
• Prioritize Workforce Sustainability and Rigorous Processes: Combat burnout by dedicating significant time to proactive improvements, fostering a culture of safety, and implementing disciplined, reproducible investigation and containment practices.
• Integrate AI Thoughtfully and Strategically: AI is an augmentation tool, not a replacement. Focus on enhancing human capabilities across all SOC tasks, prioritize quality control, and balance LLMs with traditional automation for efficiency and cost-effectiveness.

About the Speaker(s)

Carson Zimmerman is a distinguished expert in security operations, currently working at Microsoft. With extensive experience spanning many years in the field, he has a deep understanding of the challenges and evolutions within SOC environments, having started his career as a Tier 1 analyst. Zimmerman is known in the security community for his contributions to security operations literature, including his book "10 Strategies" (which he now considers outdated due to the rapid pace of change) and his more recent collaboration with Katherine Ingred on "1 Strategies," available for free download at miter.org. His background at MITRE further underscores his expertise in developing and advocating for effective cybersecurity frameworks and strategies.