I’m taking SecOps Unpacked full-time. It’s not a side project anymore.
If someone told me five years ago that this is what I’d be doing, I would definitely not believe them.
But looking back, it makes sense. For most of my career I was on the buying side. Sitting in vendor demos, reading RFI answers, running POCs, and asking the same question again and again: “OK, but what does it actually do?”
Now I get to ask that question full-time. And help the vendors answer it better.
I already shared the personal side on LinkedIn. This post is about what it means for SecOps Unpacked. What we do, how we stay independent, and what is coming next.
Vendor Evaluation Was Always My Side Job
Since my second job in cybersecurity, I was involved in picking security vendors. Over the years I managed tools that cost a few thousand dollars, all the way to millions in security budget.
And I spent a ridiculous amount of time on it. Evaluation frameworks. RFIs. POCs. Spreadsheets with weighted scores that nobody read after the purchase order was signed.
At one job I even built a program to re-evaluate every vendor, every single year. I’m pretty sure the vendors loved me for that. 😅
Here’s the funny part. I enjoyed it. Not the paperwork. The moment when you put a tool in front of real alerts, real logs, real analysts, and see what survives.
Three years ago I started a small blog about security automation. No business plan. No grand vision. I just wrote about what I was working on: SOAR, detection engineering, AI agents, metrics.
That blog became SecOps Unpacked. For three years it was a side project, run next to a full-time job. Now it is the full-time job.
Two Sides of the Same Problem
SecOps Unpacked sits between two groups that don’t always speak the same language: the people buying SecOps tools and the people building them.
For practitioners, the goal is simple. Help you find and evaluate products with less marketing and more technical substance. That means:
The vendor directory: close to 200 vendors, mapped to the SecOps AI Shift Map, so you can see who does what without reading 200 homepages that all say “agentic”.
Evaluation frameworks: ASEF (AI for SecOps Evaluation Framework), soon we will be adding the full technical profiles.
The blog and Friday SIEM: opinions, architecture, market moves. Sometimes I’m right. Sometimes you tell me in the comments.
The webcast: Conversations and interviews about what works in SOCs.
For vendors, the work is to understand the technology, challenge the approach, and help build better products, strategy and messaging. Sometimes that means telling a founder that another AI agent might not be the answer. Those are fun calls.
So, What Changes Now?
Until now, SecOps Unpacked ran on evenings, weekends and too much coffee. Full-time means the research gets the hours it needs. Here’s what that looks like in the next months.
The first AI for SecOps Market Landscape report. Coming in November, together with an updated evaluation framework. Subscribers get early access before it goes public.
Structured vendor briefings. close to 40 vendors. Each one fills a pre-demo RFI on the platform, then a 40 minute demo. The RFI starts with the vendor Shift Map placement, and the questions adapt ASEF from the POC format to a demo.
State of the SOC 2026. A survey report with BridgerWise Research. We present it at the “Mythbusting SOC Metrics” event, and everyone who registers gets the report before it goes public.
Buzz Scan. We scan the websites of every vendor in the directory to see which buzzwords they use most, and track when a vendor changes its messaging.
More webdcast and advisory time. More practitioner episodes. And more time for vendors who want an honest second opinion on product, positioning or go-to-market.
Not Exactly a Family Restaurant
Somehow we turned this into a family business. A cybersecurity research company run by a family. Not the typical family restaurant, but the hours are similar. :D
Nicoleta Stojkovski, co-founder and CMO, runs the marketing side. She does it much better than I ever could, and I learned a lot from her. I bring the technical side and, as she will tell you, an unhealthy obsession with vendor evaluation frameworks.
Rafał Kitab, our Head of Research, brings practitioner experience, an independent view and very honest opinions about the space. Because one person questioning vendor claims was not enough.
What I Need From You
A research company with no feedback is just a guy with opinions and a Substack. So here’s the ask.
If you are a practitioner:
Tell me what you are evaluating right now and what questions you can’t get a straight answer to. We want to keep SecOps Unpacked free for practitioners , so also if you need advice don’t be shy to reach out and jump on a call.
Use the frameworks in your POCs. Then tell me where they broke.
Register for Mythbusting SOC Metrics if you want the State of the SOC report early.
Want to come on the podcast and talk about what actually works in your SOC? Send me a message.
If you are a vendor:
If you think we placed you wrong on the Shift Map, show me the evidence. I’m happy to be wrong. I’m not happy to be marketed to.
A big thank you to every practitioner and vendor who supported us, challenged our ideas and trusted us. You turned a side project into a real business.
After years of building security programs, managing teams, implementing tools, and sometimes asking why we bought some of them, I’m now doing this full-time.
Thank you,
Filip