Definition
Plain language
A company's security team and the room they sit in, watching alerts and triaging incidents in shifts.
As stated in the literature
Security Operations Center — the tiered human security operation (typically Tier 1 triage and Tier 2 investigators) whose structure ADR mirrors with LLM agents for AI-agent monitoring.
Also called: Security Operations Center
Why it matters: The tiered human structure of a SOC is a battle-tested template for building scalable AI-agent monitoring, including who escalates what to whom.
For example, when an alert fires, a Tier 1 analyst triages it within minutes and escalates to a Tier 2 investigator if it looks like a real incident.
Heard on the show
“They built a software version of a Security Operations Center.”Episode 057 — How Uber Caught 206 Leaked Credentials With an LLM-Powered Security Stack