Beyond the Alert

About Beyond the Alert

Beyond the Alert features security operations leaders and SOC professionals sharing battle-tested insights on scaling security capabilities, managing high-performing teams, and leveraging emerging technologies to transform their operations. Join us as we discuss investigation techniques, leadership strategies, and real-world approaches to delivering effective security outcomes in an increasingly complex environment.

Publisher

Dropzone AI

Category

technology

Language

en

Explicit

No

First episode

7 Jul 2025

Latest episode

12 Mar 2026

Latest episodes

16 episodes in the feed.

1. 

   12 Mar 2026

   ECS's Dave Howard & Jesse Mainor on 40% Faster Triage with 12 Analysts & 30K Monthly Alerts

   ECS (https://ecstech.com/) now operates with 12 tier-one analysts instead of 14 while triaging 30,000 monthly alerts, achieving a 40% reduction in mean time to triage for Dropzone-handled alerts. Dave Howard (https://www.linkedin.com/in/david-s-howard/), Senior Director of Cyber Operations, and Jesse Mainor (https://www.linkedin.com/in/jessemadridmainor/), SOC Manager, built a hybrid model where alert sources flow to SOAR first for initial enrichment and configured auto-closure patterns, then route remaining alerts to Dropzone for structured investigation before landing in ServiceNow with complete context. Their governance approach required SOC 2 Type 2 certification as a blocking requirement before evaluating any AI vendor to prevent downstream compliance issues. Dave shares how his leadership philosophy comes from his military background: servant leadership that flips the organizational pyramid upside down, empowering teams to deliver outcomes while removing roadblocks. Jesse prioritizes hiring for curiosity over credentials, looking for investigative instinct and comfort with ambiguous, incomplete data rather than training technical tools. Topics Discussed: Building leadership buy-in for AI implementation by framing alert volume as unsustainable headcount scaling problem Establishing SOC 2 Type 2 compliance as blocking requirement before AI vendor evaluation to prevent downstream governance failures SOAR-to-Dropzone architecture where SOAR handles initial enrichment before routing alerts for structured AI investigation Breaking linear MSSP hiring model where new clients traditionally required proportional analyst headcount to handle alert volume Defining POV success criteria across five operational targets: alert overload, mean time to triage, handling consistency, context enrichment, scalability Training separate Dropzone tenants per client environment since identical alert types require different triage logic based on context Reducing analyst burnout by eliminating queue-clearing pressure and enabling deep-dive investigations, threat hunting, and detection engineering upskilling Applying servant leadership principles from military background to flip organizational hierarchy and empower SOC teams to deliver outcomes Hiring for curiosity over credentials by prioritizing investigative instinct and comfort with ambiguous, incomplete data in security analysts Maintaining 3.2% annual attrition rate by empowering analysts, providing space for mistakes, and servant leadership approach Listen to more episodes: Apple (https://podcasts.apple.com/us/podcast/beyond-the-alert/id1825166903) Spotify (https://open.spotify.com/show/49amXAmCaEyniDZ6HtD7nB?si=6416f87f6f174f4e) YouTube (https://youtube.com/playlist?list=PLkBbuaz1Cy9R6UaLtrOl31URWguaGd8So&feature=shared)

2. 

   26 Feb 2026

   How Analyst Feedback Says More Than Any SOC

   Austin Amraen (https://www.linkedin.com/in/austin-amraen-a02487179/), SOC Director at CommandLink (https://www.commandlink.com/), has built SOC teams from the ground up multiple times, and his approach challenges some of the field's most accepted assumptions. He rejects the tier-one-to-tier-three analyst model entirely, arguing that the biggest capability gap in most mature stacks isn't endpoint or identity but unmonitored network traffic, and measures SOC effectiveness not by MTTD or MTTR but by whether analysts are surfacing zero-days and proposing detection methods on their own. Austin explains why most organizations have the firewall running but nobody assigned to watch what is actually moving through it and what C2 communications, unusual outbound connections, and open ports look like when someone is finally asking "that's different, what is that?" He also gets into how he handles burnout in practice: mandatory lunch every day, one-on-ones built around career goals rather than company goals, and why process improvements that free up analyst time without reducing workload just move the problem around. Topics Discussed: Rejecting the tier-one-to-tier-three SOC model in favor of hiring senior analysts who can build and adapt NDR as the most overlooked capability gap in organizations with mature EDR, SIEM, and identity coverage Monitoring firewall traffic logs to detect C2 communications, unusual outbound connections, and unauthorized port activity Measuring SOC effectiveness through analyst-driven threat intelligence and direct customer feedback rather than MTTD and MTTR Applying micro-macro thinking from military intelligence to widen investigation scope beyond the immediate alert Preventing burnout through workload ownership, career-goal conversations, and avoiding process improvements that mask headcount gaps Building executive trust through data-driven options frameworks that give leadership decision authority on security investments Hiring for non-traditional backgrounds to build analyst teams with diverse problem-solving approaches and thought processes Listen to more episodes: Apple (https://podcasts.apple.com/us/podcast/beyond-the-alert/id1825166903) Spotify (https://open.spotify.com/show/49amXAmCaEyniDZ6HtD7nB?si=6416f87f6f174f4e) YouTube (https://youtube.com/playlist?list=PLkBbuaz1Cy9R6UaLtrOl31URWguaGd8So&feature=shared)

3. 

   5 Feb 2026

   Sneha Regmi on Using Blameless Retros to Enable High-Pressure Decisions

   Sneha Regmi (https://www.linkedin.com/in/sneharegmi/), Director of Security Operations & Resilience Engineering at a major Financial Services organization,  has an incident command framework that prioritizes scope and impact determination over immediate containment, even when executives are panicking. Her teams assign ownership in the first 60 seconds, then the lead verbalizes every decision and next three actions aloud, continuous narration that keeps stakeholders aligned and prevents chaos. She pulls subject matter experts into preliminary investigations early, building credibility to make time-sensitive calls later without second-guessing. On insider threat, Sneha flips the standard monitoring-first approach. Her framework starts with prevention controls around business-critical systems, then layers detection only where prevention blocks legitimate work. Prevention without detection leaves blind spots; detection without prevention means everything looks normal until it's not. Her teams renamed the program from "insider threat" to "insider risk" after realizing the original framing damaged organizational trust. Topics Discussed: Assigning incident ownership within the first 60 seconds and verbalizing every decision to prevent stakeholder panic Eliminating traditional tiered SOC structures in favor of engineering-enabled responders who write detections and handle incident response Prioritizing scope and impact determination over immediate containment to avoid rushing decisions during high-pressure incidents Building blameless retrospective practices that enable teams to make split-second decisions without fear during future critical situations Implementing prevention-first insider threat frameworks around business-critical systems before layering detection controls Pulling subject matter experts into preliminary investigations early to build credibility for time-sensitive containment decisions later Managing security operations burnout by setting clear escalation criteria for weekend pages versus business-hours workflows Leveraging AI and automation for alert backlog triage while reserving human decision-making for high-impact critical investigations

4. 

   22 Jan 2026

   Gilead's Allen Carter on Understanding Requirements before Deployment

   Allen Carter (https://www.linkedin.com/in/allencarter/), former Director of IT Security Operations, ran security operations at Gilead Sciences (https://www.gilead.com/) for a decade, building three teams including a global SOC across India, the UK, and multiple US locations. He developed an approach to burnout prevention where managers function as coaches who spot which team members are "struggling with a twisted ankle" before exhaustion hits,. When onboarding SOAR to automate repetitive alerts, his team saw the technology as a relief, but the implementation work to eliminate false positives nearly burned them out. He learned to celebrate the completion milestone explicitly to maintain morale through the grind. Allen's incident reporting framework separates security from IT incidents. Whereas IT outages demand "all hands on deck," security incidents require controlled information flow; the wrong person panicking early can trigger a cascade worse than the breach itself. His dual template system keeps operational details within security while board-level reports stay sanitized. He also touches on how, for technology evaluation in pharma R&D environments, less than half of out-of-the-box vendor alerts proved useful. His OT/IoT deployment went operational with massive data volumes that weren't actionable, forcing reactive tuning. Vendor relationships that prioritize understanding your non-commodity threats outweigh feature matrices. Topics Discussed: Building institutional training programs that create visible advancement pathways for SOC analysts beyond graveyard shift roles Implementing manager-as-coach models to identify team member burnout signals before exhaustion impacts performance and retention Distinguishing security vs IT incident response through controlled information flow versus all-hands-on-deck escalation approaches Creating dual incident reporting templates that maintain operational details internally while providing board-optimized communication Evaluating security tech vendors based on relationship quality and non-commodity threat understanding, not feature matrix comparisons Managing post-deployment tuning for OT/IoT monitoring to filter unusable industrial control data in operational environments Addressing clinical trial security risks where third-party hospital breaches can invalidate months of patient treatment data Hiring SOC analysts with deep technical networking knowledge over candidates with security certifications but shallow IT foundations Listen to more episodes: Apple (https://podcasts.apple.com/us/podcast/beyond-the-alert/id1825166903) Spotify (https://open.spotify.com/show/49amXAmCaEyniDZ6HtD7nB?si=6416f87f6f174f4e) YouTube (https://youtube.com/playlist?list=PLkBbuaz1Cy9R6UaLtrOl31URWguaGd8So&feature=shared)

5. 

   8 Jan 2026

   Robert Maxwell on the Peacetime vs Wartime Framework That Addresses SOC Analyst Burnout

   Robert Maxwell, Security Operations Leader, has a peacetime versus wartime operating model that gives analysts flexibility during normal operations to balance out the 16-hour days that often happen during incidents. He also automated Google Drive "did you share this publicly on purpose?" alerts into Slack bot interactions, eliminating repetitive analyst work. Robert also amplifies team successes upward and absorbs criticism downward, but scope creep kills incident response teams when executives reassign them to vulnerability management because "the IR team is good at fixing things." He touches on how eliminating entry-level roles destroys the talent pipeline for Tier 2 and Tier 3 and that alert prioritization judgment comes from processing thousands under time pressure. Topics Discussed: Using "explain how the internet works" interview questions to identify candidates who demonstrate intellectual honesty and research skills Peacetime vs wartime operating models that balance analyst flexibility during normal operations with intensive incident response expectations Automating repetitive Google Drive security alerts through Slack bot interactions to free analysts from time-consuming workflow tasks Maintaining 8-12 direct report spans of control to enable meaningful people development rather than administrative timecard management Preventing scope creep that transforms effective incident response teams into catch-all security functions Preserving Tier 1 analyst roles as essential talent pipelines for developing Tier 2 and Tier 3 expertise through alert triage experience Building alert prioritization judgment through thousands of real-world investigations rather than skipping directly to complex security work Addressing staffing redundancy failures that ignore team vacation patterns and create unsustainable SOC coverage gaps Listen to more episodes: Apple Spotify YouTube

6. 

   18 Dec 2025

   Element Solutions’ Joe Albers on OT Patching Constraints That Break IT Security Models

   Joe Albers, Director of Information Security Operations at Element Solutions, Inc., manages a six-person follow-the-sun security team with a counterintuitive framework: accept reduced alert coverage for 6 months while building strategic automation, then gain exponentially more capacity for threat hunting. His approach to AI rejects black box solutions in favor of transparent contextual enrichment that surfaces device background, related tickets, IP ownership, and cross-tool correlations directly to analysts. The OT security challenge exposes assumptions that break outside corporate IT. Joe manages environments where patching happens quarterly instead of instantly, and upgrading security tools can void warranties on multimillion-dollar control systems. His vulnerability management shifts from immediate remediation to detailed risk registers documenting why specific vulnerabilities cannot be mitigated and what compensating controls exist instead. Topics Discussed: Why deliberately sacrificing short-term alert triage for strategic automation buildout creates exponentially more SOC capacity How transparent AI augmentation through contextual enrichment accelerates junior analyst development without replacing human judgment The leadership framework that treats analyst mistakes as team failures rather than individual performance issues, creating psychological safety Why IT security's instant patching model breaks in OT environments where quarterly cycles, warranty constraints, and production disruption risks require risk registers over rapid remediation How threat actors consistently exploit holiday periods when SOC staffing drops and response capacity diminishes The vulnerability management shift from immediate IT patching to OT risk documentation Why hiring for curiosity and basic networking knowledge produces better security analysts than extensive credentials How to present security ROI by translating annual tool costs into prevented business losses Why succession planning focuses on identifying analysts who actively ask why and how rather than those with the most certifications Listen to more episodes: Apple Spotify YouTube

7. 

   4 Dec 2025

   Pew's Robert Keefer on Reversing the Defender's Dilemma in Nonprofits

   Robert Keefer, Associate Director of Security Operations at The Pew Charitable Trusts, has reversed the traditional security equation by building defense in depth that forces attackers to succeed multiple times rather than once. Unlike opportunistic criminal attacks that move on when initial methods fail, nation-state actors now specifically target nonprofits to destroy their ability to gather and disseminate truth, requiring continuous defense rather than single-point protection. His framework combines outsourced SOC providers, automated response systems, and zero trust principles, creating multiple layers where each bypass triggers immediate team response. Robert positions security as a mission enabler rather than cataloging potential disasters, showing executives how to navigate regulatory requirements like GDPR without disrupting operations. He builds partnerships by being prescriptive about security goals while leaving implementation entirely to subject matter experts, treating each team member as a force multiplier rather than someone to micromanage. The philosophy extends to talent retention through genuine work-life balance where vacation means complete disconnection, mission-driven hiring that attracts people who prioritize purpose over maximum compensation, and vulnerability as a leadership strength. Topics Discussed: Why nation-state actors now specifically target nonprofits, requiring different defense models than opportunistic criminal attacks Building defense in depth that forces attackers to succeed multiple times before reaching valuable assets rather than defending perfectly The prescriptive rather than proscriptive security approach that defines goals while leaving implementation to subject matter experts How outsourced SOC providers enable continuous level-one triage through hundreds of rotating analysts who stay alert Getting executive buy-in by positioning security as a mission enabler that streamlines operations Attracting and retaining security talent through mission alignment, genuine work-life balance, and vulnerability as leadership strength The shift from passwords to passphrases with MFA that eliminated help desk bottlenecks and half-day downtimes for remote workers. Why security leadership has become a people role, with effective leaders spending time away from computers to build partnerships The democratization of cybersecurity decision-making as organizations split CISO responsibilities by function and push security decisions down to teams doing day-to-day work

8. 

   20 Nov 2025

   DTCC's AJ Jarrett on Interview Questions That Predict SOC Performance

   Andrew “AJ” Jarrett, Director of Cyber Monitoring & Incident Response at DTCC, applies emergency response frameworks from his firefighting career to build SOC teams that execute under pressure rather than panic. His approach centers on the Incident Command System, where establishing clear roles, management by objectives, and documentation unit leaders replaces ad-hoc crisis response. Even junior analysts cycle through incident commander roles, building muscle memory for when real incidents strike at 2AM. The apprenticeship pipeline in cybersecurity faces an existential threat as organizations rush to replace tier one analysts with AI. AJ identifies this as the critical challenge for the next 5 years, not because automation is wrong but because eliminating entry-level roles breaks the path to developing tier-three analysts and team leads. His interview process prioritizes soft skills over technical certifications, asking candidates about their stress management systems, ethical decision-making frameworks, and whether they have hobbies beyond studying more cybersecurity. Topics Discussed: How the Incident Command System from emergency response creates SOC teams that execute rather than panic when incidents strike. Why reducing signal-to-noise ratios through obsessive tuning matters more than adding new security tools for managing alert volume. Interview questions that reveal whether candidates can handle SOC pressure, such as about their support systems and personal ethics. Why promoting technical experts into people management roles without leadership development creates more bad managers. How PTO as "prepare the others" ensures analysts can disconnect completely rather than remaining tethered to unfinished work. The apprenticeship crisis emerging as organizations eliminate tier-one roles without preserving the pipeline for developing senior analysts. Why AI analysts need extensive training from senior team members before junior analysts can learn from them without oversight. Moving security budget conversations from fear, uncertainty, and doubt toward quantified risk management that executives can evaluate. The shift from location-based security models to zero trust architectures accelerated by pandemic-driven remote work adoption. Listen to more episodes: Apple Spotify YouTube

9. 

   6 Nov 2025

   TransUnion's Eder Ribeiro on Teaching "Barney Style" and with Empathy

   When seven different responders and law firms were thrown into the same ransomware negotiation chat by a threat actor, Eder Ribeiro, Director of Global Incident Response at TransUnion, it became his framework for managing global incident response: map the data, map the people, and look as holistically as possible before acting. To do this, executive trust must be built long before the 3AM phone call requiring million-dollar decisions. Eder breaks down complex security issues "Barney style" and with empathy, remembering that instruction works best when adapted to how the audience receives it, not how the teacher wants to give it. For emerging AI risks, he's tracking prompt injection as the attack vector that creates a more linear path to data, particularly in enterprise bundle add-ons that sit in the gray zone between public tools and properly isolated solutions. When investigations spiral, he returns to "control the controllables," reset without finger-pointing, and compress what should take weeks into days. His military-informed leadership philosophy centers on generating agency and freedom for his team, accepting that incident response inherently lacks balance and compensating through daily autonomy. Topics Discussed: Learning holistic incident response through multi-responder ransomware coordination requiring collaboration Building executive trust through "Barney style" communication that adapts technical concepts to how leadership receives information Developing IR leaders through time-based training requiring exposure to diverse stakeholder reactions rather than seeking unicorn hires Mapping both data and people as critical incident response variables beyond traditional digital tooling and endpoint visibility Controlling the controllables during spiraling incidents by resetting without blame and compressing investigation timelines Tracking prompt injection as emerging AI attack vector creating linear data access paths through enterprise bundle add-ons Generating agency and freedom as leadership philosophy compensating for incident response's inherent lack of work-life balance Retraining security awareness beyond grammar errors as AI-powered phishing eliminates traditional detection indicators Listen to more episodes: Apple Spotify YouTube

10. 

    23 Oct 2025

    Cyderes’ Stephen Fridakis on Why IT & CISOs Are the Moon (They Reflect)

    Cyderes' CISO in Residence Stephen Fridakis’s vulnerability management framework rejects the "list problem" mindset — scan, report, patch what you can — in favor of contextual risk assessment. His approach asks four critical questions: Is this vulnerability applicable to my environment? Can it actually be exploited? Will exploitation expose sensitive data? This methodology allowed his teams to deprioritize even critical vulnerabilities like Log4J when they existed in inaccessible systems with no valuable data, redirecting resources to genuinely exploitable exposures. During a suspected ransomware incident at a major media company, Stephen made the call to force overnight MFA and rotate all passwords across the entire ecosystem without email access since it was compromised. Production teams were frustrated, help desk tickets surged, but they didn't miss a single millisecond of production schedules. His decision-making framework centers on three elements: what happened (in human language, not technical jargon), what's at stake (customer data, operations, downtime), and the likelihood plus consequences of inaction. Security, he argues, should reflect the mission like the moon reflects the sun: never the star of the show, but essential to protect what matters. Topics Discussed: Transforming vulnerability management from list-based scanning and patching into contextual risk assessment. Distinguishing compliance from security by recognizing that audit sampling validates controls but misses components outside scope. Rejecting tool proliferation as defense-in-depth strategy and instead building layered security through synergistic people, processes, and technology integration. Building high-performing SOC teams that investigate anomalies beyond deterministic rules and connect subtle signals. Implementing AI for SOC operations as augmentation tools requiring explainability, bias awareness, and validation. Preserving human roles in AI-augmented security for business judgment, intent interpretation, executive communication, ethics, and incident response creativity. Adapting security strategy across industries by understanding mission-critical time components that determine when data controls must shift and adjust. Communicating cyber risk to executives using business language focused on events, impact in dollars and downtime, assets at stake, and likelihood of consequences. Listen to more episodes: Apple Spotify YouTube

11. 

    2 Oct 2025

    Vulnerable U’s Matt Johansen on Capturing Cybersecurity's Authentic Voice

    Matt Johansen, Founder of Vulnerable U, built a following of 133,000 cybersecurity professionals by abandoning corporate messaging for authentic practitioner-to-practitioner communication. His systematic approach combines daily content creation with AI workflows that transform security operations. This proves his "humans to the power of AI" framework, where teams multiply capabilities without losing the human insight that threat actors can't replicate. Matt's transition from finance industry silence to social media leadership offers a blueprint for cybersecurity professionals who want to share knowledge without corporate constraints. His routine of content creation — recording daily videos for over 2 years — demonstrates how consistency beats perfection when building industry influence. Topics Discussed: Building authentic cybersecurity influence through daily content creation and practitioner-to-practitioner communication. Implementing Claude,  Obsidian, and Whisper AI workflows for voice-to-research automation using GitHub issues to trigger autonomous investigation. Overcoming cybersecurity AI resistance by testing new models weekly rather than dismissing tools based on outdated experiences. Achieving sub-30-minute incident response times through natural language AI queries that eliminate variable name and IP lookups. Applying "systems not goals" framework to SOC operations by removing superhero dependencies and building automated processes. Creating vulnerability-focused content that addresses mental health challenges and burnout endemic to cybersecurity professionals through authentic storytelling. Using AI as a communication thought partner for security teams struggling to articulate budget requests and demonstrate value. Transitioning from finance industry PR restrictions to social media leadership by leveraging Instagram's untapped cybersecurity practitioner audience. Listen to more episodes: Apple Spotify YouTube

12. 

    18 Sept 2025

    ThoughtSpot's Alessio Faiella on Measuring Real ROI from AI Security Tools

    Alessio Faiella, Sr. Director of Security Engineering at ThoughtSpot, sees security teams making the same mistakes with AI that they've made with every new technology: rushing to implement without understanding the fundamentals. He's learned that the most effective AI security deployments come from teams who first attempt to build solutions internally. His approach of running 30-day AI hackathons reveals whether problems are worth solving and helps teams evaluate vendor claims with real experience. He's also developed an RPG-style unlock system for AI tool access, requiring junior analysts to master manual investigation techniques before gaining access to AI-powered capabilities. Alessio warns that traditional 2- to 3-year security roadmaps have become obsolete in an ecosystem evolving so rapidly. The result is a practical framework that cuts through AI marketing noise to focus on measurable outcomes like reduced analyst burnout and improved team velocity. Topics Discussed: The three critical misconceptions security leaders have about AI threat detection, including over-reliance on traditional metrics. Why internal AI hackathons serve as the best vendor evaluation tool, revealing the gap between prototypes and production-ready systems. The build-versus-buy decision framework applied to AI security tools, focusing on functional goals and vendor trustworthiness. How AI hype differs from measurable value in security operations, with practical metrics centered on time savings and analyst satisfaction. The RPG unlock system approach to training junior security analysts, requiring mastery of manual techniques before gaining AI tools. Why experiencing alert fatigue and false positive investigations builds essential security intuition that AI-first analysts may never develop. The evolution toward autonomous SOC operations through orchestrated agent systems rather than fully autonomous solutions. Practical ROI measurement strategies for AI security implementations, combining qualitative assessment of analyst satisfaction with quantitative velocity metrics. The enterprise adoption patterns emerging across the AI security vendor landscape, from basic chatbot integrations to sophisticated agentic automation platforms. Listen to more episodes: Apple Spotify YouTube

13. 

    4 Sept 2025

    Rezliant Inc.'s Brook Schoenfield on AI Error Rates vs Human SOC Analysis

    Brook Schoenfield, Chief Scientist and EVP of Services at Rezliant Inc., brings decades of security architecture experience to explain why SOCs function as the ultimate firewall when all other defenses fail. His mathematical framework for understanding software vulnerabilities reveals why human expertise remains irreplaceable in modern threat detection. Brook demonstrates how sophisticated attackers exploit the inevitable failure points in software-based security controls. His insights challenge the notion that SOC work is purely reactive, positioning it instead as the critical last defense that can save or destroy entire organizations. Topics Discussed: The mathematical impossibility of finding every software bug, rooted in Alan Turing's 1936 proof. How reverse engineering tools have evolved from primitive to sophisticated, making system exploitation trivial by comparison. Why the progression from initial breach signals to deeper compromise indicators creates decreasing noise levels. The fundamental difference between AI probabilistic error rates and human variable performance factors. Strategic approaches to signal-versus-noise differentiation that focus on behavioral patterns unique to malicious activities. The training-ground value of SOC analyst positions as entry points into cybersecurity careers, developing valuable pattern recognition skills. How targeted machine learning models outperform general-purpose AI systems for specific security tasks by maintaining smaller error rates. The critical importance of human creativity and nonlinear analytical thinking for detecting subtle attack progressions. Why organizations need both advanced AI pattern recognition capabilities and experienced human oversight. Listen to more episodes: Apple Spotify YouTube

14. 

    21 Aug 2025

    TALAS Security’s Paul Marco on the Four Data Types Every Security Investigation Needs

    Paul Marco, Co-founder of TALAS Security, challenges the assumption that effective security operations follow a universal playbook. His decades of hands-on SOC experience reveal that the most successful teams customize their approach based on organizational context rather than copying industry templates. Paul's methodology for complex security environments centers on four critical data requirements that enable any investigation to reach definitive conclusions. He explains how AI creates unprecedented consistency in security operations while emphasizing why human expertise remains irreplaceable for contextual decision-making. Paul also offers practical strategies for maximizing existing security tool capabilities, building trust in AI-powered solutions, and preparing for the inevitable AI arms race between defenders and attackers. Topics Discussed: Why world-class security operations require customized approaches based on organizational risk appetite, tooling, and talent. The four essential data types for security investigations: telemetry for lateral movement tracking, attribution for account understanding, comprehensive asset inventory, and detailed event data. How security teams consistently underutilize existing tool capabilities by purchasing solutions for single problems. The vendor evaluation trap where teams enter demos without clear requirements and ask "what problems can this solve" instead of defining specific needs first. AI's impact on investigation consistency, enabling standardized analytical narratives while preserving necessary human expertise. The importance of transparency in AI security tools and why "black box" solutions create unacceptable risk in high-stakes environments. Practical strategies for establishing baselines in chaotic security environments without immediately dismantling existing processes and alienating teams. The hypothesis-driven investigation methodology that separates successful security analysts from those who get stuck in inconclusive alert cycles. Budget reallocation tactics for implementing AI solutions in resource-constrained environments. Why domain expertise matters more than pure AI capabilities when evaluating security automation vendors and their long-term viability. The emerging AI agent ecosystem in security operations and the trust challenges that come with interconnected automated decision-making systems. How the speed of AI-powered attacks is forcing security teams to adopt AI defenses or risk becoming the preferred targets for threat actors. Listen to more episodes: Apple Spotify YouTube

15. 

    6 Aug 2025

    Theory Ventures' Andy Triedman on AI-Native vs AI-Feature Teams

    Andy Triedman, Partner at Theory Ventures, argues that AI is reshaping not just security capabilities, but the entire business model of security companies. Unlike traditional "insurance-style" security products that were difficult to evaluate quantitatively, AI-enabled platforms provide clear scoreboards that buyers can use to measure effectiveness, speed, and cost efficiency. This shift from relationship-based to results-based evaluation advantages product-led teams with genuine AI-native expertise over traditional sales-driven organizations. With a background spanning computational neuroscience and machine learning, Andy brings a unique perspective on how AI transforms both attack and defense capabilities. He explains why security presents particularly compelling investment opportunities due to the perpetual attacker-defender dynamic and the chronic information overload that defines security operations. He also shares frameworks for distinguishing between teams that truly understand AI-native development versus those that added AI features after LLMs emerged. Topics Discussed: How AI transforms security products from insurance-style solutions to measurable automation platforms with clear performance scoreboards. The shift from relationship-based to results-based security sales as buyers can now verify AI system effectiveness in production environments. Why security operations present ideal AI investment opportunities due to chronic information overload and the need to process high-volume, low-value alerts. Framework for evaluating AI-native founder understanding of non-determinism and experimental development processes rather than traditional sprint planning. The distinction between teams with genuine AI-native expertise versus those that retrofitted existing products with AI features after LLM emergence. Token economics and value creation ratios in AI security, comparing problems that require thousands versus millions of tokens to generate customer value. Most overhyped AI security capabilities including fully autonomous security, AI penetration testing, and AI system security solutions. Team structure evolution for AI-native companies, with dramatically leaner engineering teams using AI-assisted development while maintaining traditional go-to-market functions. Data quality requirements for AI security systems, emphasizing the need for representative training data versus cosmetic synthetic data generation. Pitch deck evolution for AI startups, focusing on technical architecture clarity and deep workflow understanding rather than broad total addressable market claims. Investment strategy implications including using venture capital to finance gross margin neutral or negative products for accelerated adoption and growth. How AI enables security teams to transition from reactive triage work to proactive threat hunting and security engineering initiatives. Listen to more episodes: Apple Spotify YouTube

16. 

    7 Jul 2025

    FanDuel's Tyler Martin on 70% Automation Without Losing Human Oversight

    In our inaugural episode of Beyond the Alert, we explore how Tyler Martin, Senior Director of Enterprise Security Engineering and Operations at FanDuel, has reimagined what a modern SOC can accomplish when AI becomes the foundation rather than an add-on tool. His team eliminated traditional shift-based operations entirely, replacing 30-40 potential analyst positions with custom agentic AI that delivers 60-70% automation efficiency while maintaining critical human oversight for complex threats. Tyler's approach challenges conventional security thinking by treating AI implementation as an engineering problem rather than a defensive strategy. His team has built internal LLMs, developed custom agentic AI for multi-tier triage work, and created reasoning-based security controls that go beyond typical identity-focused guardrails. Our host, Anne Gotay, VP of Growth at Dropzone AI, will dive deep into investigation techniques, leadership strategies, and how emerging technologies are transforming security operations through authentic conversations with practitioners who are redefining modern security. Topics Discussed: How custom agentic AI replaced traditional shift-based SOC operations while achieving 60-70% automation efficiency. The evolution from defender mindset to builder mentality in security leadership, treating AI implementation as an engineering challenge rather than a risk management exercise. Advanced AI guardrail strategies that focus on reasoning-based controls rather than traditional identity-focused security measures for internal LLM implementations. How measuring mean time to detect and mean time to remediate provides better AI effectiveness metrics than traditional ticket volume and closure rate measurements. The industry-wide hesitancy around AI adoption despite proven benefits, including uncertainty around emerging protocols like MCP and preference for restrictive rather than enabling approaches. Why treating security as an enabler for employee productivity drives better AI adoption outcomes than implementing blanket restrictions. How building custom middleware and integration tools addresses the persistent gap between security tooling abundance and actual operational workflow needs.

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

1 ratings

Contact Beyond the Alert

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.