DISPATCHES
Dispatches: analysis on SOC operating models
The short answer
Dated analysis from The Triage Desk on how security teams choose and run AI SOC, SOAR, MDR and copilot models. Every post states its publication date and the read dates of the sources it uses. Vendor figures are quoted as the vendors' own.
28 Sep 2026 · 5 min readAI SOC Vendor Moves in 2026, Sorted by Which SOC Model They ChangeNewsModelsEighteen dated announcements from January to August 2026, sorted by the operating model they push toward: agents, playbooks, managed people or analyst assistance.30 Sep 2026 · 4 min readWhat Thirteen SOC Vendors Leave Unpublished: A Count of Not DescribedDataBuyingWe tracked eleven capabilities across thirteen AI SOC and SOAR vendors. Which ones almost everyone documents, which almost nobody does, and what to ask about the gaps.2 Oct 2026 · 4 min readThree Ways a Small SOC Can Cover the Night Shift in 2026StaffingModelsA small security team cannot staff nights. Three ways to cover them: agents with a tight action catalog, a vendor's managed option, or an MDR provider, and how each fails.4 Oct 2026 · 4 min readThe One-Page Brief to Send Every SOC Vendor Before the DemoBuyingA one-page brief with your alert sources, playbooks, action catalog and staffing turns a generic SOC vendor demo into an answer to your questions. What goes on the page.6 Oct 2026 · 4 min readAgents Inside the SOAR: What AgentiX and Splunk ES Mean for Teams Staying PutSOARModelsPalo Alto's Cortex AgentiX and Splunk's move of SOAR into Enterprise Security add AI without a migration. What that offers teams that keep their SOAR, and its limits.8 Oct 2026 · 4 min readManaged Options From AI SOC Vendors: Watchtower, PLAID ELITE and MDRModelsStaffingProphet Security's Watchtower and 7AI's PLAID ELITE add vendor people to AI SOC software. How these managed options sit between an AI SOC platform and MDR.10 Oct 2026 · 4 min readMulti-Tenant AI SOC Products and What They Mean for MSSP CustomersBuyingModelsDropzone AI and Conifers describe offerings built for MSSPs. What multi-tenant AI SOC means for providers, and what a company buying from an MSSP should ask.12 Oct 2026 · 4 min readNIST's Draft AI Quick-Start for CSF 2.0: What SOC Teams Should NoteStandardsNewsNIST's initial public draft of SP 1353 offers AI prompts and use cases for CSF 2.0 analysis and reporting. What it covers, what it does not, and how SOC teams can respond by 15 October.