Tom Wentworth's posts

How to build effective runbooks for your SOC

Learn how to create clear, practical runbooks that help your SOC respond faster and with fewer errors. A step-by-step guide for building, maintaining, and improving runbooks that actually get used.

Automated incident response: Why it matters and where it’s headed

For years, incident response has been a mostly manual process: someone gets paged, scrambles to investigate, loops in the right people, and after some firefighting, hopefully resolves the issue before too many customers notice. But as modern systems become more complex and interconnected, the old ways don’t scale. That’s where Automated Incident Response (AIR) comes in.