Friday SIEM post is here , this week I wanted to bring to your attention The Agent Builder Layer and ISOC.
If you caught last month post, the SIEM ate the SOAR entree, is finishing the AI SOC main dish, and agent builder is now on the dessert menu.
CrowdStrike, Datadog, Databricks, Elastic, Google SecOps, Palo Alto and many others are adding this. Most are beta or pre-GA, but the direction is clear.
How this has layered over time:
SIEM → added SOAR → added AI SOC → now adding Agent Builder
(and many other things in between but for the sake of the argument I keep it simple)
The SIEM has also been going through major re-architecture in the past few years, and today I was reading a great post by David Bizeul who mentioned that Gartner is working on a new category: ISOC (Integrated Security Operations Center).
https://lnkd.in/dxUDfjxq
This can grow into the new term for next-gen SIEM platforms. Because we all know calling it "next-gen" is lame.
How many years will it take for the new term to stick? Who knows.
But I see SIEM vendors going with "SIEM is dead, long live ISOC" sooner than later.
Side note: if you ask me, I would have gone with Intelligent over Integrated.
But Gartner probably has reasoning behind that choice. Integrated signals the convergence of multiple tools into one platform, which is a safer analyst framing than betting on AI staying central to the definition long term.
Working on a more in-depth piece on this for the blog next week.
Until then, have a great SIEMless weekend.
Originally posted on LinkedIn on 22 May 2026.
Read the original post and the comments.