Latest story4 min
In the World of AI, Are you Valuable?
I recently met the owner of a good company that is likely to go out of business. Every company loses customers, and he can survive that. What he can't…
Read the latest story →The Fluency Blog
The thinking behind The Unbounded SIEM
Detection engineering, agentic security operations, and the architecture underneath. Written by the people building it.
Explore all articlesLatest storyUpcoming live events
Join our upcoming events.
Two focused sessions on how AI is changing security operations—from the SOC to the tools already moving through your business.
Oct
14
Live webinar
Reimagining SOC Services
How AI lets security providers move beyond detection to deliver risk clarity, governance evidence, and board-ready guidance that makes them part of the CISO's team.
Chris Jordan and Henry Denner · Moderated by Patrick Evans
Reserve your seatRegistration is hosted securely by Livestorm. Event reminders and access details are sent after registration.
The Fluency newsletter
Read the next piece in your inbox.
Detection engineering, agentic security operations, new reports, and the architecture underneath The Unbounded SIEM.
The Blog
Latest thinking from Fluency
58 articles
Visit the official Fluency blogSOC6 min
How AI Changed the SOC, Part 4: Analyst Rankings Are Not a Buying Signal
A registrant asks why anyone would buy from a startup when enterprises listen to Gartner. Chris Jordan on quadrants, QRadar and ArcSight, why small…
Cybersecurity6 min
Learning from South African Data Sovereignty
South Africa's data sovereignty isn't only a government problem. The frameworks and products already exist; what's missing is the ability to operate them.…
SOC11 min
How AI Changed the SOC, Part 3: A Certificate Is Not a Fitness Test
The concrete pillow: you can be fully compliant and still sell nobody what they wanted. Chris Jordan and Henry Denner on inherited compliance, what really…
SOC13 min
How AI Changed the SOC, Part 2: AI Changed the Speed, Not the Technique
Chris Jordan of Fluency Security and Henry Denner of ASI Connect on what mean time to detect should actually measure, why AI scales quality rather than…
SOC10 min
How AI Changed the SOC, Part 1: An Alert Machine Is Not a SIEM
What does a SOC deliver for what it costs? Henry Denner of ASI Connect and Chris Jordan of Fluency Security on noise, clustering, cases, and why a SIEM that…
8 min
The LLM Proxy, and How to Put Your Agents Behind One
The exhibit floor at Black Hat this August had one theme, and it was not subtle. Roughly 235 of the 450 or so vendors on the floor marketed AI or agentic…
8 min
What makes an MCP Headless?
"Headless" is a programming term, and it's older than the AI conversation now borrowing it. It describes a simple situation: a program wants to work with an…
7 min
AI Did Not Change the Attack
Loading the Elevenlabs Text to Speech AudioNative Player... “AI is compressing the cyber kill chain” is a warning that now appears throughout the security…
6 min
Kimi is Not K3
Articles comparing Kimi K3 with Claude Fable 5 often describe the result as Kimi competing with Claude. That comparison sounds reasonable because each name…
7 min
Get Ready for Swarm
Loading the Elevenlabs Text to Speech AudioNative Player... Swarm AI is becoming a prominent term in AI marketing, often presented as a meaningful advance…
5 min
Agentic Client Workflows
If you use Claude CoWork, Codex, or another agentic coding environment, you’ve probably noticed that you spend less time inside the applications that…
11 min
Gartner’s Flaws Exposed by IBM’s Collapse, Again
Whether Gartner calls it an endorsement or not, executive teams use the Magic Quadrant to plan technology roadmaps, build procurement shortlists, and make…
3 min
AI Can Scale Execution. It Cannot Scale Maturity.
The current AI discussion is heavily focused on execution. Can AI investigate alerts? Can it write code? Can it summarize documents? Can it perform the work…
4 min
Labor Efficiency to Token Efficiency
Efficiency used to be measured through labor. Organizations invested in software, automation, and process improvements to reduce the amount of human effort…
2 min
A Note from Chris
Hi everyone, The way we interact with software is changing. Over the past several months we’ve watched a growing number of security professionals spend less…
5 min
Human "In" vs "On" the Loop
Last year we proposed that AI would not eliminate the role of the security analyst. Instead, it would redefine it. As AI became capable of performing…
8 min
Delivering Logic as a Service
Fluency is releasing a major architectural change designed specifically for AI-assisted operations. The architecture is intended to work with emerging…
Data Fabric5 min
Data Strategy is your next move
I just got back from two weeks in South Africa. It was one of the more intense business trips I’ve had in a long time. ... But by the end of the trip, it…
2 min
Defining the Modern SIEM
Most people still think of a SIEM as a giant database. You see it in how they talk about platforms like Splunk, Sumo Logic, or Elastic. The conversation is…
AI6 min
AI Feels Smarter Because the System Is
A better experience must mean a smarter model. A more helpful response must mean the model is learning. This assumption is natural, but it is also incomplete.
AI5 min
The Rare “2026 Cyber Prediction Blog” thats good
Daniel Miessler wrote one that genuinely stood out, "Cybersecurity Changes I Expect in 2026: My thoughts on what's coming for Cybersecurity in 2026". I read…
AI3 min
Ingext Community Edition
Ingext Community Edition is now available as a self-hosted, Kubernetes-based deployment, distributed using Helm charts. This release makes Ingext platform…
SOC5 min
Data Fabrics are no longer Optional
The way we move data is broken. Every SIEM on the market is choking on its own telemetry, and vendors are finally admitting it.
News3 min
Ingext Architecture
Ingext is a data fabric designed to treat all telemetry—regardless of origin, format, or transport—within a single architectural flow.
AI3 min
Who Really Benefits from AI Research? (Hint: Not Small Businesses)
The small businesses that employ nearly half of America’s workforce are barely represented in business research.
SOC7 min
Fix Your SIEM Mess
Implementing a streaming data fabric gives organizations a new foundation of control. SIEMs become sticky not because of the technology itself, but because…
Cybersecurity8 min
Lack of an Agentic Framework is a Security Issue
Because there is no Agentic AI framework, there is no way to enforce security.
AI9 min
Being Rude Produces Better AI Results
If both rudeness and politeness can make the AI more accurate, what is actually changing inside the conversation?
Cybersecurity8 min
Why We Need a Data Fabric
In recent years, data fabrics such as Ingext, Cribl, and CrowdStrike’s Onum have become increasingly popular, not only because they simplify data…
Cybersecurity2 min
How to Check Office365 Accounts for MFA
You can detect configuration changes in real time through audit events, rather than relying on annual or periodic reviews to find MFA issues.
SOC7 min
Run Your SOC like an MSSP
MTTD and MTTR measure speed. They do not measure the effectiveness of the overall operation.
AI4 min
Your Brain on ChatGPT: A Layman’s Take on the MIT Study
Curious what happens in your brain when you let ChatGPT, or any AI, do the heavy lifting? The team at MIT’s Media Lab recently tackled this exact question…
Cybersecurity7 min
What Makes a Next-Gen SIEM?
The technology for SIEM continues at a rapid pace. It's an easy statement to make, but what are the basic features that define today's Next-Gen?
SOC10 min
AI SIEM Global Roadmap
The Global AI SOC roadmap defines that progression as five distinct phases, Atomic, Role-based, Process-based, Action-oriented, and Self-learning, and…
AI5 min
AI Picks the Winners, Here’s How to Get Chosen
Recent research published in Proceedings of the National Academy of Sciences and covered by Futurism has revealed a surprising phenomenon: large language…
Cybersecurity11 min
SIEM for SMBs
Small and mid-sized businesses (SMBs) face many of the same security pressures as global corporations, so how to get the same SIEM capabilities?
News6 min
Deskilling. AI is Making Us Dumber.
When professionals depend too heavily on AI systems, the fundamental acts of analysis, interpreting, judging, and deciding, can deteriorate.
AI3 min
The More You Know, the Less You Trust AI, And That’s the Problem
A new study shows the more you know about AI the less you trust it—what that really means for hype, adoption, and the coming AI bubble.
AI10 min
Who Watches the Watchers?
This article addresses a rising skepticism about whether vendors are sufficiently transparent, accountable, and secure.
SOC9 min
The Insides of a SIEM
The real value of a SIEM isn’t in storing data, it’s in the process of transforming, interpreting, and routing that data into something usable for security…
SOC18 min
SIEM vs Data Lake
It’s easy to mistake a Security Information Event Management (SIEM) for a data lake. Both ingest large volumes of telemetry, offer search capabilities, and…
AI5 min
Why Generative AI Hasn’t Reshaped Business
95% of AI pilots fail to deliver measurable business impact. Only 5% of enterprise AI projects reach operational deployment, and even fewer show sustainable…
AI2 min
Do we use AI to defend from AI?
AI-assisted attacks are not yet being uniquely defended by AI-aware systems. Most defensive tools using AI are blind to whether the adversary used AI at…
SOC9 min
The SIEM Beneath the AI Icing
What are the characteristics of a SIEM that make it a good match for AI workflows and AI in general?
AI4 min
Security in ChatGPT-5
ChatGPT-5 modifications, while not overhauling the core architecture, alter the way the system communicates, guides decision-making, and handles potentially…
SOC10 min
The Identity Game: What Does it mean for SIEMs?
IdentitySIEM isn’t a new technology—it’s a long-overdue shift in perspective, recognizing that identity, not machines, is the foundation of meaningful…
News6 min
Is Docker Right to Warn About MCP?
Docker issued a strongly worded security advisory urging developers to stop using the Model Context Protocol (MCP), citing widespread vulnerabilities that…
News7 min
State of AI Vulnerability 2025
The Reality of AI Vulnerabilities: What the Data Actually Says There is no shortage of bold claims when it comes to the risks of adopting AI. Industry…
Cybersecurity7 min
Prompt Injection
Prompt injection is a relatively new term in cybersecurity, and one that many people are still unaware even exists.
AI5 min
Understanding MCP for use in AI-SIEM/SOAR
if we’re going to move beyond toy examples and build real, automated Gen-AI workflows — especially in high-stakes domains like SOAR or SIEM — we need more…
SOC5 min
Jobs in an AI-SOC
You feel the ground shifting—and you should. AI isn’t nibbling around the edges of the Security Operations Center (SOC); it’s coming straight for the jobs,…
Cybersecurity11 min
How do AI Workflows differ from SOAR Playbooks?
You have two logins. One from Spain. One from Switzerland. Eight minutes apart. The system fires an alert: “Impossible travel.” But here’s the problem—it’s…
SOC9 min
Rethinking the SOC Three-Tier Model
In cybersecurity, operational models are more than academic—they define how teams respond to threats, allocate resources, and maintain continuity. At the…
AI2 min
What is AI's Job with a SIEM?
The rise of generative AI has reignited excitement across cybersecurity, with many looking to these tools as accelerants for investigation. The most…
Cybersecurity6 min
Deploying and Maturing a SIEM for Effective Security
By Chris Jordan: I often write on more advanced topics, but I find there is a lack of good material on that gap between buying products and starting…
Cybersecurity4 min
The Evolution of Cybersecurity: From Hacking Culture to AI-Driven Defense
By Chris Jordan The Early Days: A Culture of Curiosity For many in my generation, movies like WarGames might have been the spark that ignited an interest in…
Cybersecurity4 min
AI Is Turning Security Operations Inside Out
Security operations have always faced the fundamental challenge of scale. Years ago, when I started working in cybersecurity, we knew the volume of data…
News1 min
Phase 3 in Beta
Phase 3 marks a major advancement in how AI supports security operations—not by simply analyzing alerts, but by understanding process.
