EP244 The Future of SOAPA: Jon Oltsik on Platform Consolidation vs. Best-of-Breed in the Age of Agentic AI

Secure running. Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Tim Peacock, the Senior PM for Detection, UEBA, and Risk in Google SecOps, and of course, Anton Chuvakin, a reformed analyst and now senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. Anton, we are talking about Koala today?

No, no, not Koala. Let's not spoil it, but it is something that Actually looks like koala, but it does not rhyme with koala.

Nor does it have anything to do with koalas.

It has absolutely nothing to do with koalas except for, you know, we should really try to build the koala connection because it feels like a fun use of 1 minute we have for the chatter, right?

Well, it seems a little bit more like we should have the koala connection on the koalas episode, which I've always thought sounds a lot like koala as well.

Okay, whenever that happens. But I feel like we have an ex-analyst on this call, and it's not me.

An extra ex-analyst.

Extra ex-analyst. That's correct. And it's going to be very fun. And of course, AI would make an appearance. And it's also one of my observations is that I felt like we absolutely did not intend this to be AI skeptical in any way.

No.

But the episode kind of gently veered to slight agentic skepticism and slight, maybe slight AI skepticism as well.

Although I think I agree with our guest when he says, I'm not an AI skeptic, I'm an AI realist. I felt like our guest was being extremely realistic about the state of AI adoption.

That's also very fair. I felt like this is— he did say immediately that the long term, he's a big optimist.

Yes. So maybe with that, listeners, let us know what you think in the show comments, on LinkedIn, on the Cloud Security Community page, whether we are skeptical or just right when it comes to our views on the coming or not of AI adoption. With that, listeners, I am delighted to introduce today's guest. Today we are joined, and I hate to say this, another ex-analyst, John Olszczak, a security researcher and ex-ESG analyst. John, thank you so much for joining us today. I am once again outnumbered on the show, but I will find a way to survive. You are, among many other things, the inventor of this SOAPA concept, Security Operations and Analytics Platform Architecture. It's one of Anton's, I think, favorite concepts. And so as we're looking at Soapa, and tell me if I'm pronouncing that right, in 2025—

Sopa.

Sopa.

Sopa.

Sopa, not Soapa. All right, well, I kind of like Soapa.

But yeah, it does sound like it rhymes with koala, right?

Koala, Soapa. Hopefully we're not left clinging to a tree in terror after this. What do you see as the progress in the ongoing debate between consolidating security on a single platform versus the disaggregated best-of-breed approach? And, you know, I think as an obvious follow-up, how does MCP change the calculus on that?

Oh, lovely.

Well, let me start with some background. So I was around during the '90s when SAP really kind of took over the ERP space and replaced a lot of departmental applications. And it was a real struggle for companies The consulting companies made a lot of money customizing SAP, but ultimately it changed business processes, it changed efficiencies, it really changed the way businesses are run. And that's what I originally thought of with SOPA or SOAPA. Now, what I didn't think was it would become single vendor dominated. So the platformization of today kind of makes sense in retrospect, but I didn't think of that. I thought of sort of an open architecture. In fact, I'd say the A of SOPA architecture was the most important thing. Now, how has it progressed and where do I see it going in terms of centralization versus decentralization? I'd say all the— there are 3 primary layers to SOPA. One is the— it was, I think we referred to it as a common storage services layer. And I'd say between some of the pipelining technologies and some of the—

Storage services.

Data lake technologies, that's happening. There was a common analytics layer, and that is different. And what we envisioned was different analytics tools being able to access the data.

Hmm.

And I think that that has happened. And then the third was just a common workbench, which became SOAR and now is kind of intersecting with AI. So I think those things have happened. Certainly the platforms have a great opportunity Google included, and some of the competitors. But I do think in the largest enterprises, which really was our vision for SOPA, there will always be heterogeneity. There'll always be new types of applications. And I also see more verticalization of security moving forward. So I think there has to be a decentralized aspect to it. And I'm hoping it goes beyond just vendors sort of bilaterally working with each other, that there's more standards.

Mm-hmm. Point-to-point, kind of like point-to-point argument where it's integrated, but not really like in any kind of coherent manner.

Yeah. And it's, I take you out for a steak dinner and you get your developers on it. And then we train our salespeople to do it. That's fine. And I understand the money-making aspect of that, but I think it would do our industry and our customers a lot of good if we, Google, Microsoft, Cisco, Palo Alto, etc., came to some standardization there. But I'll continue on my soapbox when I need to.

You mean your sofa box?

Sofa box, presumably sofa.

Yeah. Why didn't I think of that? That's good.

You know, we've been podcasting together for too long when we make the same joke at the same time.

It's both funny and depressing at the same time, but like depressing in a good way. I don't know. Sorry, I'm pushing my metaphors too far into the corner. But I want to push a little bit, not push, push, push, maybe a little cruel.

Probe?

I'm still, I don't have a clear picture in my head as a result because I feel like every day I use LinkedIn, which we use for this. Like, sometimes I go to LinkedIn and I see somebody start screaming about platformization, how they're smarter than, say, consolidation, but they imply there's this big security platform, they're emerging from different vendors, and that's the future. In the next blog, the next post, somebody else is screaming about decoupling, how you have to buy storage from this vendor and analytics from another vendor. It just hurts my head because I see both of them loudly opine about this. And you probably are in a uniquely excellent position to explain this because how can we both be driving to decoupling in many cases and at the same time driving to platformization? I'm lost.

Well, you're not alone. I think it's an easy subject to get lost in, but I think the easy demarcation point for me, Anton, is market and organizational size and resources.

Mm-hmm.

At a certain point, I mean, this is where XDR caught on, too. At a certain point, companies cannot put together a modern security operations center, and so they will throw up their hands, and they'll either do a platform from a single vendor Mm-hmm. Or they'll go to an MSSP, or they'll do some hybrid between the two. And I think more and more you'll see that architecture, the hybrid architecture. But the largest enterprises, it seems to me that they could have a great relationship with Google or Palo Alto or Cisco Splunk or whomever.

Mm-hmm.

But based on their business model, based on technology proliferation, based on cloud development, it's It can't be all centralized. It can't be platformization. And so, they're going to have to make those changes. Now, one of the— I'd say in the next few years, if you are a security architect, write your own ticket because you have skills that are going to be in very, very high demand. And so, if you can afford one of those people and you're a large enterprise, well-resourced, and you're looking to transition your SOC, not modernize, not upgrade, but transition, then I think it will be a SOPA-like architecture and it will have to be heterogeneous. But if you're a smaller organization, this is complex now, it's only going to get more complex. That's where platforms come in and that's where MSSPs come in. So hopefully that leads a little bit of logic to this debate.

It does for me. I mean, I think it pushes platformization. I mean, as So, your summarized, overly simplified, and slightly cynical take on this would be that platformization is kind of for SMBs and small enterprises, but everybody who is large and really means it would use decoupled tools.

Well, kind of. So, I'll just give you an example. So, I've been doing a deep dive into healthcare. I mean, if you look at the future of healthcare, there's so much technology proliferation. They're very aggressive users of AI for diagnostics, for clinical use, and for administrative use because the margins are terrible. They have remote technologies. They have IoMT, which they put the M in there for Internet of Medical Things. Mm-hmm. Yep. We're doing telemedicine. So my point is, there's a tremendous proliferation of technology. The business will drive that, yet we know historically they've been really bad at security. So you could have very large metropolitan teaching hospitals going for platforms because they see it as the best compromise for them. We'll see. I think all of the big SOC vendors, including Google, will have the adequate MSSP partners to help enhance their offering because historically, as we've seen, people buy these things and then they don't know how to use them.

Oh yeah. The skills issue will always remain.

Yes.

So I do want to keep picking on this MCP thread because I think the generative AI era offers maybe a wave of transformation for that smaller end of the market. And so with the buzz around generative, the buzz around agentic, how do you think this changes that SOAPA divide between the smalls and the bigs?

I'm not sure it does. I think everyone will take advantage of the basics. So in my research, where agentic or where AI is making sense at all in security operations is all in automating easy— not easy stuff, but repetitive stuff. Easy?

You mean like patching Windows every month, right?

Yeah, but—

Can't you just do that Tuesday night?

Ignore it.

It's all of those tedious things that a level 1 analyst has to do— ticket management, alert triage, all of those things. And that should be an efficiency gain for small and large organizations. I think what happens, though, is that if you're a large organization, you will get incrementally more value. But at a certain point, things are getting too complex. And I don't think the vendors, especially a lot of the startups, will catch up. Now, most of them aren't trying to. They're trying to emulate human behavior and automate that, which is all good. But again, I think it gets complex. So the way I see it playing out is that AI will remain tactical for large organizations, and it will be much more strategic for smaller organizations who are looking at kind of basic efficiency gains, basic threat detection. I mean, if there's a sophisticated attack, they're going to be screwed in the future as they are now. Forget about AI. AI, correct.

Yes, exactly.

So I don't know if I answered your question, Tim, but that's where I see the divide.

No, I think that was a great answer. I actually really like that.

I think it does make sense.

I think Anton has a good follow-up on that, though.

Yeah, I want to drill down a little bit in the AI and SOC because that's another, quote unquote, LinkedIn annoyance, at least that it is seemingly a favorite topic for a lot of people to discuss. There are some people claiming— somebody, maybe Richard Stienon, maybe somebody else claimed that there are 130 startups doing AI SOC, which to me is a little staggering.

Only?

No, I thought it's 30, but he said 130.

I believe it.

So, I don't know. I feel— I don't. I think that's way too much. I think definition is too broad. But a lot of this is kind of very promising. But I think that this RSA team and me walked around the RSA floor and we thought, promising, promising, promising. Where's the delivery? Like, give me the data. So, given that you do research in this, including like, where do you see AI actually work in a SOC today? And what do you think is a realistic AI SOC vision? Like, it's kind of a dual question, more like today and the realistic future, if it makes sense.

So first, if there are 130 companies out there doing AI SOC, there's a lot of stupid money.

Oh yes, that's fair.

A lot of stupid money. And I've met with some of those guys on Sand Hill Road occasionally. A lot of smart people, but that's a bad example. I think both kind of, it's almost a similar answer here. As I mentioned before, the smart companies that I've talked to in this, a lot of their founders have either run a SOC or worked at one of the big security operations companies, and they've picked off the things that the SIEM vendors haven't gotten right. So alert triage, alert aggregation, threat intelligence analysis, threat intelligence reporting. It's really kind of basic stuff. So just a generative AI interface to do prompt engineering based on what you've seen and figuring out next steps. Really, I mean, good stuff, but basic. That's what I'm seeing today.

Mm-hmm.

Now, I think some of the promise, like I say, looking at every alert and doing better diagnostics on every alert. Doing better ticket management, things like that. That's where I see it today. And in the near future, I think it improves a little bit. I'm not a big proponent of agentic AI anytime soon. And I heard a great interview with someone doing what, again, what she said was SOC transformation, not SOC modernization.

Manisha?

Possibly. Maybe I was—

I think it was. I think that was you guys.

Yeah.

And what she said was really smart, and that is, before you add the AI, you've got to get the basics down.

Hmm.

So, what data do you need? Who has access to that data? Do you need all of the data? Do you need certain fields? Are your processes in place? Do you have the right communication? Do you have the right escalation processes? Are you doing testing of your detection and your response? All of those things, if you layer on AI on top of broken processes, it's not going to help. It's just going to make it more efficient to make mistakes.

So given that background then, is it really the case that AI will be strategic for small players who so often struggle with exactly those basics, or is it just going to make their problems worse while they think it's improving?

Well, I don't think they have the sophistication of workflows and runbooks and automated processes and good communication. I mean, let's face it, you get smaller organizations and you've got IT people doing security. So I think—

Oh, we heard from one guest who literally described the security lead for a hospital as being the guy who cut the lawn on Fridays.

I hope that's not my local hospital. Probably not with all the heart, but anyway, that's a scary thought. And that, and by the way, in my research, I'm finding very similar stuff.

So it's In fairness to that guy, I think he was more of a security expert than a lawn care expert, but that's kind of the state a lot of these players are in.

Yes.

Yes. It is. Can AI really help them though? Because I don't know, I've seen automated lawn care robots, but can AI really help their SOC?

I think it can, but I think the gains again are incremental because if you don't really know what you're doing, it can guide you. And maybe if you had a third party in there coaching you or doing some consulting, helping you, I think it could. But I think if you want the most out of AI and you're a small organization, find a really strong MSSP because— and I've written a lot about this lately— MSSPs live and die by what they can use AI for, what they can automate, and how do they get the human factor and the costs out of what they do to scale. And so, they're going to be very innovative with their use of AI. And that's what I would recommend to anyone in that situation.

You know, there's something deliciously ironic here where, you know, what you're describing is really transformative was the basics of blocking and tackling that Maneja was describing. And what we're saying is not transformative is this revolutionary technology.

I mean, the way I— and you guys did the podcast and you know her, and so you probably have more experience, but What I thought was you need a strong foundation.

Yes, for sure.

And then you can get the AI benefits. But really look at what I heard her saying is, what do you want to accomplish from a business perspective?

Yes.

Okay, then get the basics in place and then find the weak spots or the spots that you do want to automate where AI can add value. So that's a strategic plan versus going to your local neighborhood SIEM vendor and just saying, okay, yeah, that's pretty cool. What else can you do with AI?

Which is unfortunately where some of the things are. Your colleagues from— your virtual colleagues from Gartner and Forrester both shared that they sort of expected more robust value by now. Weirdly enough, I've heard a very similar lament from both Gartner and Forrester leads. This is the one quote from me reading a new document Gartner released mentioned that AI and agents is not driving SIM purchasing. Like, it's not— it's good, it's okay, fine, whatever, but it's just not driving the decisions. It's kind of a cool add-on that if you have it, that's great, but that's really it.

This is turning out to be a very, like, AI skeptical episode. I'm kind of enjoying this.

I think it's the— we're trying to shape the expectations to something you can hit and see the evidence that you're hitting, right?

And I think we'll get there. I really do. I'm not a pessimist on this. I think I'm a realist. And there's a lot of grunt work in a security operations center that needs to be automated. Now, there's a fundamental question there. It's like, do we want to automate level 1 analyst work and maybe some level 2 analyst work, or do we want to re-engineer the SOC based on that? Anton, I've seen you write about this, but make it more engineering-driven. So more detection as code, more engineering in terms of alert triage.

Mm-hmm.

Now, AI will help there, but again, you have to have a fundamental strategic plan before you go about this. And then you can know where AI fits. If you do that, if you have that, then I think you're right. When you write your RFP, AI is a component, but you're looking at other things.

Okay. That actually makes sense. And I think that's probably a good way to structure it so that it doesn't become excessively, you know, crazy land expectations, whatever. This is kind of— that to me does make sense.

Yeah. And I think everyone's trying to cover their behind, I'll say, in terms of marketing. So you go to RSA, you go to Black Hat, and everyone has to talk about this because you're keeping up with the Joneses. But when you do talk to the actual practitioners, a director of the SOC or a security architect, it's much more of a holistic discussion.

So I want to switch gears a little bit, and I think it does make sense, and it does bring us to the concept of In my analyst days, we used to be quite allergic to this because when a vendor would tell us, oh, we integrate X, Y, and Y, a lot of us would just kind of freeze and say, okay, what do you mean? Like, what happens between X and Y? What is the actual thing that you're doing? Because it's just such a broad umbrella term. And whether you have the platform that's integrated or 2 tools integrate or we integrate using MCP, Can you almost like de-chaosize? Can you reduce the amount of chaos around this? Can you help us maybe using a SOPA filter understand this? What is a good scenario for integrated security tools?

When I came up with SOPA in 2016, I really was hopeful on some standardization. And so this was pre-Open Cybersecurity Framework, but I envisioned something like this. Like that. There were some other standards coming out of different standard bodies, and I can't remember them right away, but they were more in the orchestration space. But what we've evolved into is either a vendor-centric integration play or maybe some API integration. And that's one that the industry is really taking a hold of. Yeah, we integrate, we have APIs, That doesn't tell you much, as you know. I mean, that's— are the APIs open? What services can I access over the APIs? What can't I access? And then there's the competitive things too. I've even seen where VCs get involved and really preclude some of the APIs being open to perceived competitors of other companies in their portfolios. So there's a lot going on there. This one baffles me, guys, because you would think— so I'll give you another historical example. Back when I started in security in the early 2000s, there was a group called the Jericho Forum, and it was financial services.

Yeah.

Yeah, you remember. So financial services companies, and their big thing was deperimeterization. And what's that mean? And actually, if you think of logically where that got to, it was zero trust. That's what we need is we need the biggest companies in the world to say to the security vendors, look, we need some standardization here. And these are the kinds of things we need. Now, maybe I'm being Pollyanna here, but I don't understand why the vendor side and the user side hasn't come to this conclusion because to me, it's beneficial to everyone. So just maybe you can go to your management and say Google could lead this charge and work with Microsoft or work with Palo Alto. Again, maybe it's idealistic on my part, but I don't think it changes the competitive landscape. I think it means that you're all competing on feature functionality and not integration. What do I know?

That is certainly an interesting concept to think about. I hate to do it, but we're at the point in the show where I need to ask our traditional closing questions. One, do you have a tip to help people get more out of their SOC, maybe a tip for small players and a tip for big players for their SOAPA world? And then 2, do you have recommended reading or, or resources to recommend to people on this?

Okay, so a tip, we don't mean the threat intelligence platform, by the way.

We really mean an actual tip.

Yeah.

Like advice.

Yeah. I, so I'm a big proponent of what MITRE calls the threat-informed defense.

Mm-hmm.

And so really understanding, and this is obviously an 80/20 thing, but I think the 80% makes sense. Is really understanding who's attacking you or your industry or your geography, how they're doing it, and then using that to develop your security strategy. So what tools do you need for your defenses? What do you need in terms of detection rules? How should you test the efficacy of that system? So the more you can do that, the better. And it doesn't mean you need penetration testers or red teamers on staff, but consider that lifecycle. I think that applies to smaller and larger companies. I'd say the fundamentals are really important. So I'm doing a lot of work on the whole vulnerability and exposure management space. Really, really difficult. And for some reason, and I've been at this since the early 2000s, we still have no clue on how to get it right. Now, that doesn't mean there's an idealistic space you're going for, but we should be trying to make steady progress and the business should be involved. The business should be pushing that. So where am I in terms of tips? I guess those are 2 tips. In terms of reading, that's a good question. I do a lot of fictional reading.

We like that.

And I combine my 2 passions. So I've read the Mark Russinovich stuff. I've read the Daniel Suarez.

Yeah, yeah, of course, the Daemon and stuff. Yeah, that's good.

Yeah, and then Tom Clancy here and there. I think especially if you're trying to get into security, that's a good way to get into it because a lot of it's factual. And so you get to see what we're up against, and then you can backtrack into what you need to know. So I'm not doing any kind of textbook reading right now. Semi-retired. So those are the things I'm looking at.

Delta V. Yeah, that part is— I just finished it recently.

Yeah, yeah, he's great. Yeah, he's great. It really makes you think.

Yeah, really gripping.

Yes.

Yeah. Well, John, thank you so much for joining us today.

My pleasure, guys. Anytime. As an ex-analyst, you can share my pain.

And now we are at time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast.

By Google.