<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Regulation on CybersecurityOS</title><link>http://www.cybersecurityos.net/tags/regulation/</link><description>Recent content in Regulation on CybersecurityOS</description><generator>Hugo</generator><language>en-us</language><lastBuildDate>Wed, 21 Oct 2026 02:33:05 +0000</lastBuildDate><atom:link href="http://www.cybersecurityos.net/tags/regulation/index.xml" rel="self" type="application/rss+xml"/><item><title>The SOC Gets a New Org Chart: Five Security Operations Predictions for 2027</title><link>http://www.cybersecurityos.net/posts/secops/security-operations-2027-predictions/</link><pubDate>Wed, 21 Oct 2026 00:00:00 +0000</pubDate><guid>http://www.cybersecurityos.net/posts/secops/security-operations-2027-predictions/</guid><description>&lt;p&gt;Last week I argued that the bottleneck in detection engineering moved from writing rules to investigating alerts. If you missed it, start with &lt;a href="http://www.cybersecurityos.net/posts/secops/detection-engineering-2027-bottleneck-moved/"&gt;The Bottleneck Moved: Detection Engineering Heading Into 2027&lt;/a&gt;.&lt;/p&gt;
&lt;p&gt;This post zooms out to the whole SOC. Detection is one function. Security operations is the system around it: who triages, who acts, what telemetry matters, what the SOC owns, and whose clock it runs on.&lt;/p&gt;
&lt;p&gt;All five of those are changing at once. By the end of 2027, a lot of SOCs will have a different org chart than the one on the wall today.&lt;/p&gt;</description></item></channel></rss>