Field notes

Writing about defense.
From people doing it.

Research, post-mortems, benchmarks, and craft. No FUD, no thought-leadership template. Just notes from the SOC floor.

The 2026 SOC-Agent Benchmark

800 real alerts. Five vendors. Triago and three peers, scored by independent analysts. The full methodology, dataset, and scoring rubric — open and reproducible.

Mar 12 · 18 min read

Engineering

Why our verifier model is independent of the investigator

Same model = correlated errors. Different models = real coverage.

Feb 27

Research

Abstention is a feature, not a fallback

The right number of "I don't know" verdicts isn't zero.

Feb 14

Field notes

What a SOC manager wants from an AI

Notes from 40 customer interviews in eight weeks.

Feb 02

Engineering

Designing approval policies that don't get ignored

Policy-as-code, written for humans who page at 3am.

Jan 21

Research

Prompt injection in production: what we caught

180 days of adversarial input — patterns and defenses.

Jan 09

Company

Why we named the company Triago

Triage. Vigilance. A short name with a long obligation.

Dec 20

A monthly note from the team. No promotions. Just craft.

Writing about defense.From people doing it.