Can You Build an AI SOC with Claude Code? The Reality vs. Hype

22 snips

Oct 21, 2025

Ariful Huq, Co-founder and Head of Product at ExaForce, dives into the complexities of building an AI-native SOC. He discusses why bolt-on AI approaches fall short and the necessity of integrating data beyond logs, including configuration and business context. Ariful emphasizes the evolution beyond traditional SIEM capabilities and the importance of real-time processing. He also highlights the need for full-stack security engineers and outlines the challenges posed by SaaS platforms that lack native threat detection.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

INSIGHT

AI-Native SOC Needs First-Principles Data

Building an AI-native SOC requires starting from first principles, especially the data platform, not just bolting LLMs onto existing tools.
True outcomes demand config, code, business context, and AI-native task design across detection, triage, investigation, and response.

ADVICE

Feed Agents Precise Context

Give LLM agents precise context (logs, config, permissions, code) to remove guesswork and produce predictable outcomes.
Design detections and triage to leverage anomaly models and context so agents surface only items needing human attention.

INSIGHT

LLM Services Aren't The Whole Stack

Agentic SOC platforms require custom orchestration beyond base LLM services (retries, async tasks, upgrades, agent management).
Bedrock or similar gets you started, but production agent systems need additional infrastructure and engineering.

Get the Snipd Podcast app to discover more snips from this episode

Get the app