The security operations stack is splintering into separate, specialized components. Gal Shafir, founder and chief executive of Fig Security, contends that managing this distributed architecture at scale requires the same engineering discipline that DevOps brought to cloud infrastructure: treating everything as code.
For the past twenty years, a single SIEM platform served as the backbone of any Security Operations Center. This monolithic approach handled data ingestion, parsing, storage, normalization, enrichment, detection logic and investigation support all in one system. Ownership of a SIEM essentially meant ownership of a functioning SOC.
That unified model is now dissolving. Shafir, who spent years working on SIEM infrastructure at Google SecOps, observes that most mature security teams have already begun dismantling this architecture.
The SIEM-centric era is ending. Teams are splitting the stack into pieces that each do one thing well. Pipelines handle ingestion and filtering. One SIEM brings free ingest and great content for certain logs, another runs the custom, high-stakes detections. A data lake or object storage sits beside them for retention and hunting, with federated detection engines running across all of it. The SIEM is still there, as one first-class component. It's just not the whole SOC anymore.
Gal Shafir
The stack is getting cheaper, better, and much harder to engineer
The benefits of this shift are substantial. Specialized tools perform their individual functions with greater efficiency, data resides in the most cost-effective storage tier for its type, and organizations eliminate the expense of processing all information through premium-priced centralized platforms.
Shafir draws a parallel to the evolution of application infrastructure.
Apps went from client-server to Kubernetes and microservices. Everything got more scalable, more efficient and cheaper. It also got far more fragmented, and that created a whole new discipline to run it. DevOps engineers made it work because they got the tools: CI/CD, infrastructure as code, observability. SecOps is going through the same unbundling right now, without those tools.
Gal Shafir
Each additional component introduces its own configurations, schemas and dependencies that evolve independently. A single detection rule now depends on a source, a pipeline, a parser, a schema, a field mapping and a rule itself—often maintained by separate teams across different products. Each tool documents only its own piece of the puzzle, leaving no visibility into the entire flow.
Artificial intelligence amplifies these challenges. Detection agents are proliferating across the stack: analyst agents within SIEMs, hunting agents on data lakes, red team agents examining telemetry and pipelines. All of them operate on the same fragmented data infrastructure. According to the 2026 SANS SOC Report, 79% of SOCs have deployed AI or machine learning tools, yet only 36% have integrated them into a formal SOC workflow.
AI never doubts its input. You can have the best agents in the world, and they'll tell you everything is fine, because the alert they should be investigating never fired. A field got renamed upstream, the rule is looking for something that doesn't exist in the data anymore, and nobody knows.
Gal Shafir
Organizations are hiring engineers, not more analysts
The composition of security teams is shifting as rapidly as the technology. As AI assumes more of the triage and investigation responsibilities that once defined SOC work, organizations are not converting analysts into engineers. Instead, they are reducing staffing for analyst roles that AI can now perform and recruiting engineers to build more sophisticated detection and response capabilities from increasingly complex infrastructure.
Most organizations remain in the early stages of this transition. SOC-CMM's SOC Maturity Report 2026, which surveyed approximately 200 SOCs, determined that "most SOCs still operate with more analysts than engineers." The same report projects this will shift: "With SOCs moving towards a higher level of automation, with and without AI, engineering will play a more important role in future SOCs."
Everyone we talk to is hiring engineers right now. Pipeline engineers, detection engineers, SIEM engineers. They all run one flow that has to produce detection and response, and that flow gets harder to engineer every quarter.
Gal Shafir
Source: The Next Web
