Writing on security, AI, and autonomous SecOps.https://www.alankrit.io/https://www.alankrit.io/blog/the-eager-soc/https://www.alankrit.io/blog/the-eager-soc/A security investigation is slow because it gathers context the way it always has: reactively, one artifact at a time, because thinking used to be the expensive step. Cheap calibrated decision models flip that. Pull the whole context bundle up front, decide once, and you can judge every event instead of the few a detector flagged.Wed, 30 Sep 2026 00:00:00 GMThttps://www.alankrit.io/blog/sycophantic-soc/https://www.alankrit.io/blog/sycophantic-soc/A story about a self-improving SOC that did everything right: three correct dismissals, a model that learned from each one, and an intrusion that walked through the boundary it drew. Analyst feedback can only describe attacks that happened. The value of a detection lives in the ones that haven't.Mon, 14 Sep 2026 00:00:00 GMThttps://www.alankrit.io/blog/everyone-is-an-ic-now/https://www.alankrit.io/blog/everyone-is-an-ic-now/AI harnesses reward long solo sessions, so collaborative roles are turning into individual contributor roles. But the solo time they produce is supervision, not flow. Managers lost the room; engineers lost the zone; both landed in the same new mode.Mon, 31 Aug 2026 00:00:00 GMThttps://www.alankrit.io/blog/residual-risk-triage/https://www.alankrit.io/blog/residual-risk-triage/Anton Chuvakin is right that triage must die. But the filter is only half of it: the binary verdict is the real 2003 artifact. An investigation never proves 'benign'; it runs out of budget. The honest output isn't true-positive or false-positive. It's the risk you couldn't rule out.Tue, 25 Aug 2026 00:00:00 GMThttps://www.alankrit.io/blog/how-to-train-your-ai-attacker/https://www.alankrit.io/blog/how-to-train-your-ai-attacker/Walk through the actual RL loop that makes an AI better at breaking in, cell by cell. Then run the identical loop for defense and watch it die at one cell, the reward, which is why offense keeps pulling ahead.Fri, 14 Aug 2026 00:00:00 GMThttps://www.alankrit.io/blog/the-unbounded-investigation/https://www.alankrit.io/blog/the-unbounded-investigation/One risky sign-in alert, five good analysts, five different investigations, all defensible. Why a security investigation has no natural end, why 'benign' has no proof, and the one move that makes detection measurable.Tue, 04 Aug 2026 00:00:00 GMThttps://www.alankrit.io/blog/verifiability-across-industries/https://www.alankrit.io/blog/verifiability-across-industries/Some work you can check in seconds. Some you can never check at all. That gap, verifiability, quietly decides how work gets trusted and priced, and where AI actually creates value.Tue, 28 Jul 2026 00:00:00 GMThttps://www.alankrit.io/blog/patch-is-an-attack-map/https://www.alankrit.io/blog/patch-is-an-attack-map/Patch-diffing was never new - attackers have turned fixes into N-days for decades. What changed is the labor. When an agent can read a fix and build the payload in an afternoon, the exposure window becomes a race you're now losing by default.Mon, 08 Jun 2026 00:00:00 GMThttps://www.alankrit.io/blog/ai-soc-alignment-operators/https://www.alankrit.io/blog/ai-soc-alignment-operators/SOAR and AI SOC aren't two flavors of the same tool. They're two different contracts with your vendor - and the shift moves your best people from monitoring the queue to aligning the system.Fri, 05 Jun 2026 00:00:00 GMThttps://www.alankrit.io/blog/reading-tea-leaves-ai-frontier/https://www.alankrit.io/blog/reading-tea-leaves-ai-frontier/Frontier AI capabilities don't debut at keynotes. They're assembled in training data pipelines - and the hiring patterns are visible months in advance.Thu, 16 Apr 2026 00:00:00 GMThttps://www.alankrit.io/blog/architecture-designed-for-removal/https://www.alankrit.io/blog/architecture-designed-for-removal/Every system in history was designed to last. AI agent architecture is the first that should be designed to disappear. The best code you write today is code that becomes unnecessary tomorrow.Tue, 07 Apr 2026 00:00:00 GMThttps://www.alankrit.io/blog/wtf-is-security-context/https://www.alankrit.io/blog/wtf-is-security-context/The industry uses 'context' as a synonym for 'more data.' It's not. Here's a first-principles framework for what context actually means - from events to chains to storylines - and why most SOCs are stuck at Layer 1.Sat, 28 Mar 2026 00:00:00 GMThttps://www.alankrit.io/blog/tribal-knowledge-context-analyst/https://www.alankrit.io/blog/tribal-knowledge-context-analyst/The greatest vulnerability in the modern SOC is not a lack of data - it is a lack of memory. How tribal knowledge, context lakes, and a new role called the Context Analyst change everything.Mon, 16 Mar 2026 00:00:00 GMThttps://www.alankrit.io/blog/fixed-capacity-soc-liability/https://www.alankrit.io/blog/fixed-capacity-soc-liability/We treat the SOC as a defensive funnel, but functionally it's a bottleneck. When attack volume goes exponential, a fixed capacity model forces you to ignore the vast majority of signals to save the sanity of the team.Mon, 09 Mar 2026 00:00:00 GMThttps://www.alankrit.io/blog/dismissed-alert-technical-debt/https://www.alankrit.io/blog/dismissed-alert-technical-debt/Maliciousness isn't an inherent property of an event - it's a property of its relationship to future context. Every dismissed alert is a liability on your balance sheet.Mon, 26 Jan 2026 00:00:00 GMThttps://www.alankrit.io/blog/overfitting-detection-engineering/https://www.alankrit.io/blog/overfitting-detection-engineering/Every time you tune a detection rule to silence a noisy alert, you're hard-coding a blind spot. We're trading false positives for false negatives.Mon, 26 Jan 2026 00:00:00 GMThttps://www.alankrit.io/blog/long-context-windows-attacker-advantage/https://www.alankrit.io/blog/long-context-windows-attacker-advantage/AI's expanding context windows sound like a defensive breakthrough. In reality, they're structurally easier for attackers to exploit - attackers save the whole board state while defenders rebuild from fragments every move.Sat, 24 Jan 2026 00:00:00 GMThttps://www.alankrit.io/blog/secops-chaos-engineering/https://www.alankrit.io/blog/secops-chaos-engineering/Security is theoretically simple. But SecOps in practice is a war against entropy - where the real task isn't correlation, it's intent recognition.Wed, 21 Jan 2026 00:00:00 GMThttps://www.alankrit.io/blog/scaffolding-trap-agent-architecture/https://www.alankrit.io/blog/scaffolding-trap-agent-architecture/Teams build elaborate state machines to compensate for model limitations. The result benchmarks well - and doesn't think. Your architecture is a commitment, not a snapshot.Mon, 05 Jan 2026 00:00:00 GMThttps://www.alankrit.io/blog/great-unbundling-of-rag/https://www.alankrit.io/blog/great-unbundling-of-rag/We spent two years perfecting our RAG pipeline. Then our AI started reading markdown files from a filesystem instead of querying our vector store. This isn't a bug - it's the future.Tue, 07 Oct 2025 00:00:00 GMThttps://www.alankrit.io/blog/detection-bias-trap/https://www.alankrit.io/blog/detection-bias-trap/AI SOCs inherit and amplify human bias - favoring detections that reduce workload over ones that maximize threat coverage. Without a sparring partner, even AI-generated rules drift conservative.Wed, 03 Sep 2025 00:00:00 GMThttps://www.alankrit.io/blog/homunculus-fallacy-gpt5/https://www.alankrit.io/blog/homunculus-fallacy-gpt5/You can't explain intelligence by inserting another intelligent agent. If GPT-5's router needs sophisticated judgment to route intelligence, who's routing the router?Tue, 26 Aug 2025 00:00:00 GMThttps://www.alankrit.io/blog/risk-is-unquantifiable/https://www.alankrit.io/blog/risk-is-unquantifiable/Howard Marks argues you can't quantify risk even after the fact. We've built an entire vulnerability management industry around measuring the unmeasurable.Fri, 20 Jun 2025 00:00:00 GMThttps://www.alankrit.io/blog/false-positive-rate-ai-soc/https://www.alankrit.io/blog/false-positive-rate-ai-soc/False Positive Rates were never about detection accuracy - they were always about human capacity. AI triage changes the equation entirely.Sun, 11 May 2025 00:00:00 GMThttps://www.alankrit.io/blog/bitter-lesson-security-operations/https://www.alankrit.io/blog/bitter-lesson-security-operations/Sutton's Bitter Lesson says intelligence emerges from scalable learning, not encoded knowledge. Does that mean we'll outgrow MITRE ATT&CK?Tue, 06 May 2025 00:00:00 GMThttps://www.alankrit.io/blog/impedance-mismatch-secops/https://www.alankrit.io/blog/impedance-mismatch-secops/SecOps reasoning is graph-based but our data arrives as time-series logs. This impedance mismatch - like ORMs bridging objects and tables - is the core data engineering problem in security.Thu, 06 Mar 2025 00:00:00 GMT