After conference week we have the Friday SIEM post. Even though I was not on InfoSec or Gartner summit this year, this week flew by.
So I will start with the Latio report, I went over it yesterday. For those that didn't see it..
They just dropped their 2026 Security Operations report. Good work. I like how they break the categories, clean and honest about where the lines blur.
I really like "The Guide to Modernizing a SOC Program." visual. That flowchart is the report. It starts in the right place: do you already have a way to ingest and search log data? Everything branches from there.
Adding my take.
If you are running a SIEM migration, or call it SOC modernization, the first question is usually: should I go decentralized data? And in many cases yes, it makes sense. Cheaper. Sometimes faster.
But do not rush.
First check if your current SIEM already supports decentralized data. A lot of them added bring your own bucket and federated search in the last two years. You might already own the thing you are about to migrate for.
Then ask. Why do you want to change the SIEM in the first place? Is it just cost?
If cost is the only reason, fix the data pipeline and the storage tier. You do not need a new platform for that.
If it is more than cost, detection portability, query speed, analyst experience, then maybe you do need different tech.
But understand what you are signing up for. New tech means new processes. You will re-tune detections, retrain analysts, rebuild runbooks.
The migration is the easy part. The process change is the work.
The report sequences it well: optimize the pipeline, decouple the detection engine, then move the data. Half-finished migrations are how teams end up with logs sprawled across three places and nobody sure where they live.
And only then look at where AI SOC fits your case. Agents sit downstream of your data. Bad data in, hallucinations out. No AI analyst fixes a broken data architecture.
More on my next release of the SecOps Shift Map.
LI anyways hates links,so just dropping them here anyhow probably I rolled the dice on low engagement because I want to share links 😅
In case you missed my blog from yesterday around Agent Builders for SecOps: https://lnkd.in/eefyJPjD
And Latio report: https://lnkd.in/eKGa8bKW
Originally posted on LinkedIn on 5 June 2026.
Read the original post and the comments.