The Decision Bottleneck
For years, Security has talked about alert overload as one of the biggest problems facing the SOC.
I’ve certainly thought about it that way. Security products generate too many alerts. Analysts can’t keep up. The answer, naturally, is fewer and better alerts — enter Detection Engineering.
But Embed thinks that framing alone misses the real bottleneck.
Alerts aren’t the bottleneck. Decisions are.
Security teams have invested heavily in collecting telemetry, detecting suspicious activity, and orchestrating response. We can collect more data, generate more detections, and execute response actions faster than ever. Thanks to SOAR, this has been an improvement, but not a full solution.
The work between detection and action, however, is still largely constrained by our ability to reach a trusted decision. What actually happened? Does it matter? How severe is it? What should happen next?
Those are decisions. And increasingly, they are the limiting factor in how security operations scale.
Over the last decade, nearly every part of the SOC has become more capable.
Security teams collect enormous amounts of telemetry across endpoint, identity, cloud, email, and network. SIEM, XDR, and security data lakes have made that evidence more accessible. Detection engineering has expanded coverage and improved the quality of signals. SOAR and response tooling can execute actions in seconds.
All of that matters.
But none of it, by itself, answers the questions an analyst ultimately has to answer:
- What actually happened?
- Is this activity malicious, benign, or unknown?
- Does it matter in the context of this organization?
- What should we do about it?
We have dramatically scaled our ability to observe, detect, and execute. But, we haven’t scaled our ability to decide at the same rate.
What is the Decision Bottleneck?
The Decision Bottleneck is the gap between receiving a security signal and reaching a trusted, evidence-backed conclusion that allows the organization to act.
Let’s explore what happens after a detection fires. An analyst gathers evidence from multiple systems. Then has to determine which evidence matters. Understand the user, asset, application, and business context. Develop and test hypotheses. Decide whether the activity is malicious. Consider severity and potential impact. Then decide what, if anything, should happen next.
The expensive part is everything required to turn that alert into a decision you trust.
That distinction becomes even more important when the majority of alerts ultimately turn out to be benign or otherwise require no action. The SOC still has to do the work to know that they are benign.
Why hasn’t the bottleneck been solved?
Security has attacked the problem from multiple sides.
- Better detection engineering improves the signals entering the SOC. Better detections reduce unnecessary work, but they don’t eliminate the need for investigation and judgment.
- Automation and SOAR attack the other side of the problem. Once we know what should happen (the playbook), they make it easier to execute quickly and consistently.
But automating execution doesn’t solve the question of whether or what action should be taken in the first place. That leaves a gap in the middle:
Signal → Evidence → Decision → Action
We have spent years improving Signal, Evidence, and Action. Decision is now where the greatest opportunity lies to improve security operations.
Your AI SOC should be the Decision Layer
This is why Embed thinks about AI SOC differently than a copilot, a collection of agents, another automation platform, or simply an extension on an existing product.
The opportunity is to build a Decision Layer for security operations.
That layer should continuously gather evidence, understand organizational context, apply security expertise, reason across competing hypotheses, and produce an evidence-backed decision that an analyst can verify.
And importantly, the decision layer cannot stop at alert triage.
The same capability is required when deciding whether a detection should change, whether an emerging threat applies to the organization, whether an investigation should expand, or whether a response action should be taken.
The underlying problem is the same: turning security data into trusted decisions.
The goal isn’t simply to generate fewer alerts. It’s to make better decisions and to make those decisions fast enough, consistently enough, and transparently enough that security teams can finally scale. As threats move at machine speed, security teams need a way to reach trusted decisions just as fast.
