Your AI SOC isn’t model-bottlenecked. It’s starving for context.
I made a case a few months ago in No King, No Kingdom that the Agentic SOC will live or die on data, which seemed a bit ahead of the market then. The agents’ cleverness, or the cleverness of the model behind the agents, was never the variable. The outcome is determined by whether the data they reason over is investigation-grade or merely raw log exhaust with a chat interface slapped on top.
The market has since caught up, and then some. Now, every SOC conversation I have comes with the assumption of AI agents. Not if they exist but what they run on. And the more I work through it with various security leaders, the more I’m convinced that I understated the problem the first time. “Data is King” was right, but it was just the setup. Because an agent drowns in a sea of the best data in the world if it’s sitting in 90 different schemas across 90 different platforms.
If an AI SOC is going to work, it comes down to what you do to that data before an agent ever sees it.
That work is Context Engineering for the AI SOC, and I think it's the most important and least discussed layer of the entire Agentic SOC.
The truth about "better AI"
The market wants to believe that the path to a better SOC runs through a better model. You buy the smartest agent, point it at your stack, and watch it work.
I understand the appeal. It's also mostly incomplete.
Hand the best model on the market a pile of raw, uncorrelated logs and it takes on every problem your SOC already has. Schemas may not match, so it reconciles them on the fly. Identities fail to resolve, whether human, non-human, or agentic. Retention windows close at 90 to 180 days, long before the investigation needs them. And the cross-platform attack path isn't correlated or modeled anywhere, so the agent can't see the second hop, let alone the hundredth.
Give that same agent panoramic, correlated, deterministic context, and you get quite a different picture. It starts to reason well – because the context and input got smarter between Tuesday and Wednesday. A modest agent reasoning over investigation-grade context beats a state-of-the-art agent reasoning over messy data. In No King, No Kingdom, I tried to be blunt, writing that smart agents running on dumb data make confident, convincing, wrong decisions. They just do it at machine speed. Model quality is a commodity today, but context quality is the differentiator, and it is the part that very few have built across the modern infrastructure.
What Context Engineering for the AI SOC means
The term “context engineering” comes from AI engineering, not security, and it's reshaping how people build with AI. With context engineering, the quality of the context you feed an agent is more important to its dependability than the model size. So, you engineer that context deliberately, with the smallest, highest-signal, most trustworthy set of information the agent needs to reach a correct answer, and nothing else.
For machine-speed security in the modern SOC, that discipline is everything.
The context must satisfy a prescribed standard before an agent ever interacts with it, since an agent inherits the reliability of whatever it reasons over. "Investigation-grade" isn't a marketing adjective. It's four specific properties, each of which an agent depends on and raw logs categorically lack:
- Normalized. One consistent structure and format across all planes of the entire modern infrastructure – cloud, SaaS, identity, third-party services, and AI – deterministic and AI-ready.
- Correlated. One identity's activity stitched across the identity provider, the cloud control plane, SaaS apps, and AI services into a single, panoramic timeline. If you have to reconcile eight exports by hand, it becomes a significant challenge. This scenario is the exact "someone has to assemble the fragments" problem I described in Machine Speed Won, except now the someone is an agent, and it can't.
- Retained. More than 1,000 days of normalized history, past the native windows that expire mid-investigation. You can't reason over evidence you threw away, or perhaps didn’t even ingest in the first place, to save on the SIEM tax.
- Attributed. Who did it, from where, on whose authority, including the non-human and agent identities that increasingly have no person behind them at all.
Strip any one of those away and the agent becomes weaker – and in a way a model upgrade won’t fix. Context engineering is the work of delivering all four, by construction, before the agent is ever invoked.
Why this is the hardest part and why the market keeps proving it
If context engineering for the AI SOC were easy, everyone would already have it. It isn't, and they don't. Watch where the market is spending its money, and you can see it conceding the point.
On one side, detection-and-response vendors are racing to bolt on a data layer. CrowdStrike now pitches pipelines that "filter out noise at ingestion so agents only process what matters," and Torq bought Jit for its context graph. On the other hand, data-platform vendors are buying their way into detection. Databricks agreed to acquire Panther in June, and Cribl picked up CardinalOps and Radiant's AI SOC assets within five weeks.
Microsoft's Satya Nadella has been the bluntest about where the moat moves once models are interchangeable. "Your moat as a company is your tacit knowledge," he told Stratechery in June, and on Microsoft's July earnings call he said it harder, "every model is substitutable."
The missing context is the white space I wrote about in Machine Speed Won. The attack timeline almost always exists, but it’s scattered across five or six systems. Someone has to assemble it fast enough to change the outcome. I argued then that this runtime gap, between the controls you already own, is where the real risk exists. Context engineering is the discipline that closes the runtime gap. It's what turns those scattered fragments into the single, correlated narrative that an agent or an analyst can act on.
The economics haven't gone anywhere either
I spent a good part of Machine Speed Won on the economics because a control that improves one risk while making your operating model worse somewhere else isn't progress. That logic applies here with a vengeance.
The agentic SOC on lazy mode is to dump all raw logs into a general-purpose platform and turn agents loose on it. This is the most expensive possible way to be wrong. You pay the SIEM tax to store telemetry you can't fully investigate, and then you stack an AI tax on top because agents burn tokens reconstructing context that should have been handed to them pre-built. Raw logs are expensive to store, expensive to process, and expensive for agents to reason over. You lose three times.
Context engineering is the remedy. Normalize, correlate, and enrich the data once, upstream and aggregation-first, and the agent gets a small, high-signal input instead of a firehose. Token cost drops because the agent isn't rebuilding context on every invocation, and you stop paying premium rates to hold raw data you can't turn into an answer. In No King, No Kingdom I called the trap "smart agents on dumb data." The economics end up the same way. The fastest way to make an AI SOC expensive is to feed it raw logs and call it innovation.
Where this shows up in the stack
I'm allergic to positioning that floats free of architecture and application. Start with the modern infrastructure (cloud, SaaS, identity, third-party services, and AI) that attackers move across and endpoint tools can't see.
The engineered context lives in the Agentic Substrate. A security data lake described by what it stores is a commodity. What it does for AI is to give agents deterministic, correlated, investigation-grade context to reason over. That’s an entirely different thing, and it’s the same lake. The difference is the context engineering you did to the data before the SOC agent arrived.
That's also why this case isn't a rip-and-replace argument. And, as I said in Machine Speed Won, layer first, rationalize later. Context engineering feeds your SIEM better data, gives your SOAR better triggers, and hands your own Agentic SOC, and whatever orchestrator platform you've chosen, context it can effectively reason over, exposed over MCP and API. It makes the rest of the stack better. If it doesn't, why the hell add it?
Proof, not posture
An agentic substrate is a supply-side marketing claim until something reasons over it in production. Ours does. Helios AIDR includes our AI SOC analyst, and it runs on engineered context every day, which is the entire reason its verdicts hold up at scale.
Helios triages 100% of alerts autonomously, each returned as a structured, ready-to-act analysis rather than one more raw notification. It cuts false positives by 95%, with 90% to 100% noise reduction depending on the environment. It sustains 3× the signal coverage that a traditional SOC can achieve with human triage alone. And it reduces the time for a full investigation from an hour to just 10 minutes, making it 6× faster end to end.
All of those numbers are possible because of the quality of the input. Verdicts are only as good as the context behind them. Helios is built on an investigation-grade foundation. That’s why every Helios verdict holds and why an agent starved of that context, however capable, won’t get there.
The question to ask every vendor now
In No King, No Kingdom, I gave you a set of hard questions to ask before you "go agentic." I'd add one that the rest depend on:
Before your agents reason over anything, who engineered that context, and how?
If the answer is "we point the agent at your existing logs," you already know how that ends. The agent inherits every gap in your data and makes confident decisions on top of them. If the answer involves normalized, correlated, retained, and attributed context that is delivered before the agent is invoked and is exposed in a way the agent can consume cheaply, then you're looking at something that will deliver when it matters most.
Data was King. It still is. But data alone was never going to save the AI SOC. The thing that turns it into trustworthy machine-speed decisions is the context engineering you do to it first. Transforming a legacy SOC takes more than putting a smarter model on top of the same uncontextualized data. The modern SOC will live or die by engineering the context the smarter model reasons from. That's what we built.
Machine speed won. Data is King. And context is what makes the crown worth something.
EDR protects your endpoints. See how Mitiga protects everything else and gives your AI SOC the context it can trust.
