SynerComm, Inc.

During a recent discussion with Fortinet, a key theme emerged: as cyber threats evolve, many organizations are struggling less with a lack of security tools and more with the complexity of managing them.

For years, organizations have layered tools to address new threats, often creating fragmented visibility. Fortinet, recognized by Gartner as a leader in CSMA and OT, has been advocating for a platform-based approach, unifying networking, security, analytics, AI, and even OT environments.

Key takeaways:

• Security and networking are becoming increasingly interconnected.
• Manufacturing and OT environments are becoming a board-level cybersecurity concern, especially as legacy systems face modern threats.
• AI is accelerating both attack and defense, making visibility and automation more important than ever.
• Organizations are seeking ways to do more with less, such as fewer management consoles, fewer integrations to maintain, and fewer operational silos.

Today's challenge isn't simply detecting threats, it's making sense of them quickly enough to act. The future of cybersecurity may not be about adding more tools, but creating better connections between the tools, teams, and environments within organizations.

A key takeaway from a recent session with Cribl:

AI is only as valuable as the telemetry strategy behind it. Organizations are generating more machine data than ever before, but budgets, teams, and legacy architectures aren’t growing at the same pace.

Cribl’s platform is built around choice, control, and flexibility:

- Data source agnostic
- Destination agnostic
- Designed to reduce vendor lock-in
- Enables teams to route the right data to the right tools at the right time

Instead of combining all data into expensive centralized platforms, organizations are starting to:

- Intentionally tier data
- Search data where it lives
- Reduce storage and ingestion costs
- Give more teams direct access to insights without duplicating infrastructure

These changes support the evolution toward AI-enabled SOCs. Cribl explained that AI initiatives don’t fail because of lack of models, but because data is fragmented, inaccessible, or too expensive to operationalize at scale.

The future of security operations is shifting to companies that make data portable and accessible across ecosystems. This is why the telemetry layer is becoming one of the most strategic conversations in cybersecurity today.

What if your security tools are working exactly as configured, but still missing real threats?

That’s the value of purple team exercises.

By bringing offensive and defensive teams together in real-world attack simulations, organizations can identify detection gaps, improve response times, and strengthen their overall security posture before a real threat occurs.

Organizations need continuous, real-world validation of their defenses — not just vulnerability scans or theoretical risk scores.

Read more about the business case for purple team exercises, in our recent blog post, here:

Purple Team Exercises for SOC Validation Validate your SOC, EDR, SIEM, and threat detection controls with purple team exercises mapped to MITRE ATT&CK and real-world attacker techniques.

Security teams don’t have a tooling problem.
They have a workload problem.

Every new security investment → more alerts
More alerts → more noise
More noise → burned-out analysts

At some point, CISOs hit a wall:
humans can’t keep up with machine-speed threats.

The answer to this problem is a rethink of SecOps.

& we agree “SOAR is dead.”

Not because the idea is wrong, but because the ex*****on didn’t match the promise.

Torq was at the SynerComm office last week and our biggest takeaway:
Torq delivers on the original promise of SOAR while actually scaling the SOC

SOAR didn’t fail because the idea was wrong.

It failed because it was too hard to use. (Required heavy coding, needed dedicated engineers, was slow to build and maintain, & ended up underutilized)

Meanwhile… alerts kept piling up.

What TORQ is doing instead:
🔹~90% noise reduction before analysts even look at alerts
Not prioritization—elimination of unnecessary work
🔹 End-to-end AI SOC (not just triage or automation)
From alert → context → investigation → response
All in one continuous flow
🔹 No-code workflows that actually scale
No bottlenecks. No “one engineer who understands it.”
The whole team can build.
🔹 AI with guardrails (not a black box)
Full visibility into decisions
Auditable, explainable, controllable
🔹 From ticketing → to action
Not just managing incidents…
Actually resolving them at machine speed

If you’ve ever seen a SOC team trying to keep up with
hundreds (or thousands) of alerts a day…

Then you know that “AI SOC” is becoming necessary.