Cloud Security Podcast by Google EP267 AI SOC or AI in a SOC? Cutting Through Hype, Pricing Models, and SIEM Detection Efficacy with Raffy Marty
28 snips
Mar 16, 2026 Raffael Marty, longtime SIEM expert and operating advisor, explains why calls to declare SIEM dead are marketing. He contrasts centralized vs federated architectures and why locality matters for real-time detection. He covers data pipelines turning SIEM into a swappable layer, the realities of AI in SOCs, pricing problems with volume-based models, and what truly measures detection engineering quality.
AI Snips
Chapters
Transcript
Episode notes
SIEMs Aren't Dead Just Falling Behind
- Calling SIEMs obsolete is primarily marketing; the core SIEM goals remain valid but incumbents failed to fully deliver on them over decades.
- New entrants exploit temporary gaps (pricing, scale, detections) but incumbents like Splunk have data, budgets, and incentive to close those gaps.
Locality Matters For Real Time Correlation
- A fully federated SIEM struggles with stateful, cross-source detections because correlation, timelines, and real-time detection require locality.
- Hybrid architectures that push compute to the edge but centralize correlated data selectively are the pragmatic compromise.
Pipeline Vendors Turned Themselves Into SIEMs
- Data pipeline vendors became sticky by owning integrations and routing, then added search and simple detection to become 'a SIM' for customers.
- Marty cites DataBricks-like pipeline players that first optimized feeds then layered cheap storage plus search and rule engines.