Every SOC Today Is Answering the Wrong Question

Ask most detection engineers what a SOC does, and they’ll say: it finds compromised machines. That’s the wrong question. Attackers stopped compromising machines as the primary objective years ago — machines are just where identities and trust relationships happen to execute.