A frequent topic I am asked about is what the future of the SOC looks like. At first glance, this seems like a simple question \u2013 but scratch beneath the surface and it\u2019s actually really complex. Cybersecurity does not exist in its own little pocket universe. Instead, what happens in security operations is driven mainly by external factors \u2013 the economy and macro-economics, internal, external and geopolitics, social and cultural trends, fashions, and of course, natural disasters like pandemics. There is no future of the SOC independent of the Future. So if you want to talk about the future of security operations, you really have to make a whole series of predictions and assumptions about the world in general .That\u2019s what makes futurism and trend analysis so difficult. Good futurology synthesises trends from all and any relevant domains and fields into a coherent whole.<\/p>\n
It doesn\u2019t help that humans are incredibly bad at predicting the future, especially when trying to understand complex issues. We can even empirically study how bad we are at predicting, with definitions for a range of fun and scary cognitive fallacies, like the optimism or recency biases, not to mention the Duning-Kruger effect. Worst of all \u2013 even being aware of these pitfalls doesn\u2019t necessarily help prevent succumbing to them.<\/p>\n
Case in point, how will Artificial Intelligence develop in the near term, and how will this impact us as security planners and practitioners?<\/p>\n
As I write this, Microsoft just announced their Cybersecurity Copilot, a personal AI assistant for security analysts, with industry analysts cautiously declaring that \u201cAI Finally Does More Than Enhance Detection\u201d.<\/p>\n