How AI Changed the SOC, Part 2: AI Changed the Speed, Not the Technique
What did AI actually change about an attack? Chris Jordan's answer is speed and capacity, not technique: we could write a zero day before there were AIs. In Part 2 of our webinar How AI Changed the SOC, he argues mean time to detect should be measured from the moment there was enough data to make a decision, not from the first alert, and that detecting in the stream rather than in a database is what puts Fluency's MTTD in the milliseconds. Henry Denner brings the field test: same log sources, same tests, same host, and Fluency alerted in about a fifth of the time the other SIEM took, five minutes in rather than twenty-five. The point of putting AI on the data, Chris says, is not false-positive reduction but scaling quality, so the events that used to fall to the floor get evaluated at all. Agentic operations have moved from mimicking tier one through tier three, to encoded workflows, to swarm: parallel steps as a directed acyclic graph with an orchestrator doing the map reduce. And the guardrail holds. Soft responses that only inconvenience a user can be automated; hard ones that disrupt a business cannot. We are like doctors, do no harm.
Transcript
Henry Denner: Just for interest sake, what is your average mean time to detect an alert?
Chris Jordan: So mathematically, it's in the milliseconds. And the reason is because everything's in real time. So the difference is that when we look at data, remember, we engineered it saying this is the problem. The problem is I need to know when there's an alert. So instead of me having a database and searching the database, we do it all in the pipes. In fact, Cribl just released it thinking they're wonderful. We've been doing this for five years, now six.
We analyze this stuff in the stream. So we do the data transformation, the data enrichment. We do the triggering, the alerting. The alert goes into a piping system and it gets clustered. And then the alert goes off. And the key point here is that I might have a bunch of things occurring, but when can I make a decision? That's the real time to detection. It's not that I had this first alert way over here. It's when was there enough data to make a decision?
That's the real MTTD. And once that trigger occurs, our system doesn't wait to collect more data. It sends out a notification and then continues to update the case. And that's a lot different than everybody else. Everybody else has what we call frequency times the amount of data times the number of signatures equals the capacity or computation number. And that's why they limit you on the number of signatures. They limit you and they make you pay for all this other stuff.
Those are actually the variables that generate cost. I can get into it, but the reality is that the MTTD is zero. And then it comes down to mean time to acknowledge, mean time to respond, mean time to close.
Henry Denner: Awesome. Awesome. If I can share with the audience, when we went through a whole evaluation process last year in transitioning from what we have to what we now have, what we had to what we now have. And in side-by-side comparisons, Fluency consistently generated an alert in about a fifth of the time that the other SIEM actually did. And when I talk about side-by-side comparison, side-by-side, whatever data sources fed into our current SIEM fed into Fluency. We ran the same tests on the same host, so that alert would actually generate at the same time to both systems.
And Fluency was consistently at about 20, 20-odd percent of what the other one took. So from our perspective, I can really see that difference. And it's also a difference between if there's something really happening in the environment, to get an alert at five minutes in versus getting an alert at 25 minutes in. If you deal with something like ransomware or some malware that goes fast, that 20-minute gap makes a massive difference in the other state. If I have the ability to say to the client, after a few minutes, listen, you've got a problem, it's much better than actually telling the client after half an hour, listen, you've got a problem.
I reported if you're a state of already being compromised. So that spirit is really awesome. One thing I also want you to touch on is your AI agent. From what we've seen is the massive load reduction that agent has actually brought to our SOC team. Can you tell us a little bit more about how that works?
Chris Jordan: Sure. So at a high level, the big advantage of AI looking at our data is it allows us to scale quality. People miss this. They think about false positive. It's quality. It's now I can take an event that maybe would have fallen to the floor and say, evaluate it for these things before you get rid of it. It allows us to look at things that were lower noise and be able to say, no, it's actually more of an issue.
And the opposite is true, something that appeared to be nasty, to say, oh, you know what? That's an admin. He does it every other day. That's a common trend. So one thing we have to understand is that AI is not quality. The next part, though, is when we take a look at the evolution of AI. So a lot of people think, I'm going to get an alert. I get to the AI and the AI evaluates. And we talked about that earlier.
That one would call atomic event is not enough. But the AI is not going to give us any reasonable increase in capability. We have to cluster. But once we get into this workflow, there's been an evolution. The first thing we used to do is say, I'm going to do just that. I'm going to mimic the people I have, tier one, tier two, tier three. And I'm just going to pass it from person to person. And that was the first agentic approach.
The next was agentic workflows. I'm now going to forget the people. I'm going to take this process and I'm going to mimic it inside the AI and go from if A, then B, then must be C. Now technology in the last three months have changed. It always changes. Now what's happening is that instead of the steps being sequential, they're actually done what's called a directed acyclic graph. They're done in parallel as much as possible. And this technique is called swarm.
And swarm is a newer style where I do everything I can and then I do a map reduce on differentiating results. So that map reduce, what we prefer, is called orchestrator. And it gets orchestrated back into a single. And why do we do that? If A, then B, what happens if B occurred before A? It fails in the old model. So timing makes a big difference. The other piece is as the data comes in and I analyze, let's say it's impossible travel, there might have been something like, oh, the name of that machine is a virtual machine.
And it would have been lost in the evaluation of distance. Now in swarm technology, the supporting data is still there with the answer. So as the data gets compressed, the orchestrator can see lower end data that could actually influence the result. And so that type of technology is a more recent breakthrough. Kimi, this was actually a breakthrough in China, but we've already seen it in the United States and in products. I think besides us, the other product that uses this is one called 7AI.
So there is this move to swarm technology. It is agreed that it's a better technique. It's just that as larger companies, I spent so much money in the old one, I'm not going to change it. But in reality, there's been, and there will be more changes in this technology. But it's important to understand that there's been evolutions. And so when you're buying something, if someone says AI, that's just like in the old days saying, I use a computer. At one point, you have to say, what do you use the computer for?
Henry Denner: In terms of the agentic AI agent, what guardrails are there in place to, because obviously AI can hallucinate and the thing can get a bit haywire if it really wants to. What have you done on your end to make sure that there's at least some kind of limit or guardrails to prevent AI from going off the rails?
Chris Jordan: We're not doing an automated response just yet without a human intervention. We still put what's called human in the loop, and that's still the majority of our infrastructure and the majority of everybody's infrastructure today. There's very little if, then, than that. People that say use AI for response, you have to understand probably everybody in this call uses AI, and they realize how slow it is. If you're a really big AI user, you're going to have multiple tasks going on at the same time because the tasks are so slow.
Unless you want to do Duolingo or something else, they're way too slow to be productive. So the reason why I want this feed is you can't have AI automated response. A human will beat it all the time, number one. Number two, and more importantly, is that we still need to validate it before we produce an action, but we can divide the action into two folds, or actually three. One is AI learned something, I can now automate the response.
Now that we're used to, MDR does that every day. So that automation of response is the first level. The second one is it can do soft response. And that means that I'm going to do something that has no damage. I'm going to go ahead and reset tokens. It's going to be inconvenient. The person just has to re-log in. But it's a little bit of a bump that prevents somebody from passing the hash. I now have a prevention mechanism that won't create disruption.
And then we have is hard responses. And that's the ones we don't want to automate just yet today. And a hard response means I do have a business disruption. Remember, we're like doctors, do no harm. So if you divide these into three categories, what I'm saying is that we want to do as much response as possible without generating disruption. And right now, we're not in that place where I can trust AI not to have disruption.
Henry Denner: Let's talk about AI from a different sense. So a question I often get asked by clients is, can you detect AI? And I then ask them, but what is AI really? AI really is just a set of instructions that's executed at light speed. So if we look at Fluency and what Fluency brings with your streaming platform and the AI agent, how would you answer that line that says, can you detect AI?
Chris Jordan: That's a really common question. You're talking about AI attacks. And so the first thing you have to do is take a step back and say, is the AI doing anything different than a human would? And the answer is no. This is a speed question and capacity question, not a technique question. So that means that if you say, well, they can write a zero day. We could write a zero day before there were AIs. That's why we know what a zero day is.
So how do we detect a zero day? And that has a lot to do with analysis of trend and history. So a really good example is we do behavioral analytics. Behavioral analytics is perfect for AI defense. So if all of a sudden Patrick is Mac, Mac, Mac, and all of a sudden Linux, that's a change in pattern. That's a huge one. If he goes Verizon, Verizon, Verizon, AT&T or Vodafone, all of a sudden his ISP changes at the exact same time.
This is what we call supporting vectors. And at this point here, this is a massive red flag. That means he changed his provider and changed his operating system at the same time. And so as we start adding up what we call abnormal normalities or supporting vectors or faults, we realize that this is an event. It could be real. He could have just changed providers and they gave him a new phone. But we need to investigate it.
It needs to be validated. And so that's one thing AI can't do. AI can't predict what is the OS and everything. It can't mimic you perfectly. And what it can do is once it's in there, it can grab, let's say, all your invoices and generate invoices that are perfect, just changing the Swift code and the banking codes, and then resubmit it to people. So you have to understand that that part of the attack, that's what AI is really good at.
It's once it has the data, it can replicate it. It can make a man in the middle. When I'm going to Humana or some other health care system, it will create a perfect page because it can do that. AI can do that. In the old days, misspellings, this, this, this were good, good, good, good ways to a person. Now they're not there. Microsoft's ending SMS texting in February, just to realize how bad the situation is. But mimicking is what it's good at.
But what it can't do is it can't pretend it's you and know what you are. And that's always been the case with every attacker. They can't dictate what their attack platform is.
Henry Denner: Awesome. I want to come back to data. You touched earlier on the data pipelines. One thing that I found that's quite unique, and at least from my point of view with Fluency, is your capability to manipulate data and data in transit. So as the data stream coming from the log sources, you can do various things with that. Don't you just want to expand a little bit around your Ingext platform?
Chris Jordan: I have a whole book on this. Actually, it's probably the most important part that people misunderstand. So in the old days, we didn't have the volume. And so you'd get something you could look at and transform it after the fact. But they're using like relational databases and stuff. But when you move to big data, you just relational database and goes away. And I can't do joins. Joins are multiplication. So if I have a terabyte of data and a thousand signatures, now I have a petabyte of data when I do the search.
Organizations have more than terabytes. And so joins kill us. And so what we need to be able to do is enhance the data prior to it. And we call it decorating, means I'm changing the wording. Enhancing means I look up SHA-256 is to say what's the reputation. And I prep that data. I change the data that you gave me, raw data, to make it a form to answer the questions I'm about to ask. So that's the trick.
The trick is I have to, as an engineer, come up with all my questions ahead of time and then transform the data in a manner by which I can insert it. Because if I have lat long and then you say, tell me everything that came from China, I can't do that because it's lat long. So transformation says grab that lat long and change it into a country code. Change it into a city. And that then allows me to ask those questions.
This is, believe it or not, almost all the work we do in data transformation, it shows up in Gartner's AI quadrant. It's because that's what AI needs too. AI can't make decisions off of raw data. It needs to be transformed. It needs to be enriched. And that's what we do. There's a misunderstanding that says I need to normalize it. That's not important. To tell you the truth, most companies don't need to normalize their stuff. What they do need to do is enrich it and decorate it. Yeah.
Henry Denner: And this happens in flight. So this is not while the data gets written into your data lake. It needs to be in flight.
Chris Jordan: There is this idea of, I'll give you the acronyms, ETL versus ELT, which means am I going to transform it ahead of time? Or am I going to store it and then have to transform it a second time? And that thrashes the database. And that makes you do two writes. And then if anybody here is a techie, when you write, you block the database. And so now you have a situation where I can't put all the data in there and my performance goes to hell.
And I'm paying for computation, so I'm paying twice for my data going in. And so you can see that it's a mess. So, yes, you have to transform the data ahead of time. Industries begin to realize this. That's why people buy Cribl. That's why CrowdStrike buy Onum. That's why SentinelOne buy Observo. That's why Fluency is Ingext, is that this is the most pivotal technology change in the last five years in our industry, is that we realize we have to transform and enrich the data prior to storing.
About the webinar
How AI Changed the SOC aired live on September 16, 2026. It was a conversation between Henry Denner of ASI Connect, who runs security operations on the managed services front line, and Chris Jordan, CEO of Fluency Security, moderated by Patrick Evans. The session set out to answer one question: what are you actually trying to achieve with a SOC? Across four parts it covers how AI changes detection and response, what an MSSP should deliver beyond closing tickets, how data pipelines and infrastructure shape cost and compliance, and how buyers should evaluate vendors.
This post is Part 2, Speed and Intelligence. The transcript has been lightly edited for readability. Watch the full episode and the rest of the series on the Fluency Security YouTube channel, or book a demo to see how Fluency turns alerts into cases.