EP267 AI SOC or AI in a SOC? Cutting Through Hype, Pricing Models, and SIEM Detection Efficacy with Raffy Marty

The episode opens with a candid assessment of today’s security information and event management (SIEM) landscape. Long‑standing vendors such as Splunk and Exabeam still dominate, but their platforms struggle with scalability, detection accuracy, and pricing structures that no longer fit modern MSSP or enterprise budgets. Rafi Marty argues that the perceived death of SIEMs is a marketing myth; instead, incumbents must quickly address these gaps or risk being eclipsed by nimble AI‑SOC startups promising cheaper, faster alert reduction.

A central theme is the rise of AI‑SOC solutions that focus on triage and alert suppression. While these newcomers can cut false positives by up to 80 percent, the conversation highlights a recurring pattern: many are merely patching symptoms rather than solving core data‑collection and correlation challenges. The panel debates federated versus centralized architectures, noting that pure edge‑only models create a catch‑22 where analysts still need to pull data back for deep investigation. The consensus leans toward a hybrid approach—pushing compute to the edge for low‑value telemetry while centralizing high‑value events for cross‑correlation and advanced analytics.

Pricing emerges as a thorny issue. Traditional seat‑based or data‑volume models often misalign with the realities of MSSPs, who juggle dozens of customers and cannot predict data ingest rates. The hosts explore alternative structures, such as tiered alert‑per‑price or mixed‑metric schemes, emphasizing fairness for both vendors and end‑users. Ultimately, the discussion underscores that data pipelines act as a Trojan horse: they lock customers into a vendor’s ecosystem, making migration difficult but also offering a pathway for pipeline providers to evolve into full‑fledged SIEMs. For security leaders, the takeaway is clear—invest in flexible, hybrid architectures and pricing models that reward true detection value rather than superficial alert reduction.