Gal Shafir, CEO of Fig Security and former Google SecOps lead, predicts the traditional SIEM-centric SOC model will break down by 2030. Instead, SOCs will resemble software engineering teams, managing fragmented, specialized tools with advanced AI to handle complex detection pipelines.
- SIEM-centric SOCs are fragmenting into specialized data pipelines and detection tools.
- AI is increasingly embedded but creates risks from data drift and alert gaps.
- SOC staffing is shifting from analyst-heavy to engineer-heavy teams managing complex workflows.
What happened
Gal Shafir explains that the once-monolithic SIEM platform which defined SOC operations for twenty years is being disassembled into multiple discrete components. These include pipelines for data ingestion and filtering, different SIEMs optimized for specific log types and detection use cases, data lakes for retention and hunting, and federated detection engines operating across this distributed environment.
This unbundling allows each component to specialize and optimize its function, lowering costs by storing data where it is cheapest and avoiding expensive SIEM processing for all data. However, this creates a fragmented and complex stack with multiple configurations, schemas, and dependencies that require new operational practices.
Why it matters
The shift away from a single SIEM platform mirrors the evolution in application infrastructure from monolithic client-server to scalable microservices managed by DevOps teams. SOCs must undergo a similar transformation into engineering-driven operations to manage fragmentation, maintain performance, and keep up with rapid threat changes.
AI adoption is growing in SOCs, with 79% using AI tools, but only 36% integrating them into defined workflows. AI-based agents across the security stack rely heavily on accurate and consistent input data, which is fragile in fragmented environments. Without robust engineering support, automated systems risk missing threats when data formats or rules change upstream.
What to watch next
SOC workforce composition is expected to shift toward more engineers skilled in managing complex detection pipelines, rules, and infrastructure. Organizations will invest in SecOps automation modeled on DevOps practices, including Detection as Code and eventually full SecOps as Code, to improve agility and reduce operational risk.
The pace of change is accelerating, pushing teams to balance stability with innovation. Moving slowly risks falling behind threats while moving fast without engineering discipline risks undetected gaps. How effectively SOCs adopt software engineering methodologies and toolchains will influence their ability to scale and protect against evolving cyber threats throughout the 2030s.