Caliptra Blog https://caliptra.co/blog/ Notes from Caliptra on agentic AI for SOC: triage, attention, and human-in-the-loop design. en-us Playbooks are not investigations https://caliptra.co/blog/playbooks-are-not-investigations/ https://caliptra.co/blog/playbooks-are-not-investigations/ Tue, 29 Sep 2026 00:00:00 +0000 How agentic first-pass and investigation differ from SOAR playbooks for lean SecOps and MSSPs: typed verdicts, evidence trails, and less maintenance tax. Privacy is a product constraint https://caliptra.co/blog/privacy-is-a-product-constraint/ https://caliptra.co/blog/privacy-is-a-product-constraint/ Tue, 29 Sep 2026 00:00:00 +0000 Why “can’t ship customer telemetry to third-party AI” is a product constraint for lean SecOps in US/EU and early Africa/SEA: honest residency, HITL, no overclaim. Resolve the noise, don't suppress it https://caliptra.co/blog/resolve-noise-dont-suppress-it/ https://caliptra.co/blog/resolve-noise-dont-suppress-it/ Mon, 28 Sep 2026 00:00:00 +0000 Why lean SOCs should resolve obvious noise with typed verdicts and evidence, not hide it behind suppression and bulk closes. Coverage without a bigger bench https://caliptra.co/blog/coverage-without-a-bigger-bench/ https://caliptra.co/blog/coverage-without-a-bigger-bench/ Sun, 27 Sep 2026 00:00:00 +0000 How lean SecOps and regional MSSPs get investigative coverage across the alert queue without proportional headcount or another AI console. What lean MSSPs actually need https://caliptra.co/blog/what-lean-mssps-actually-need/ https://caliptra.co/blog/what-lean-mssps-actually-need/ Sat, 26 Sep 2026 00:00:00 +0000 For Heads of SOC and founder-operators at regional MSSPs: multiply L1 capacity, protect margin, keep multi-tenant HITL, without buying another AI console. A definition of done for triage https://caliptra.co/blog/a-definition-of-done-for-triage/ https://caliptra.co/blog/a-definition-of-done-for-triage/ Fri, 25 Sep 2026 00:00:00 +0000 Practical definitions of done for SOC triage: cleared with evidence, case-ready for review, and gated before consequential action. The Monday morning test for lean SecOps https://caliptra.co/blog/the-monday-morning-test/ https://caliptra.co/blog/the-monday-morning-test/ Thu, 24 Sep 2026 00:00:00 +0000 Practical Monday-queue rubric for Heads of Security and regional MSSP leads across US, UK, EU, Africa, and selective SEA: noise, cases, HITL, privacy. Human in the loop by design https://caliptra.co/blog/human-in-the-loop-by-design/ https://caliptra.co/blog/human-in-the-loop-by-design/ Tue, 22 Sep 2026 00:00:00 +0000 How Caliptra designs human-in-the-loop triage: cases, typed verdicts, and approval gates, without claiming measured outcomes. Sentry-1 and Sentry-TRM https://caliptra.co/blog/sentry-1-and-sentry-trm/ https://caliptra.co/blog/sentry-1-and-sentry-trm/ Thu, 17 Sep 2026 00:00:00 +0000 What Sentry-TRM and Sentry-1 each do in the Caliptra path: first-pass typed verdicts and purpose-built SOC reasoning, without invented metrics. Attention is the scarce resource https://caliptra.co/blog/attention-is-the-scarce-resource/ https://caliptra.co/blog/attention-is-the-scarce-resource/ Thu, 10 Sep 2026 00:00:00 +0000 Why SOC triage fails under alert volume, and why protecting analyst attention, not adding more tools, is the real design problem.