The Human Experience of Security Operations

Chris Tillett opens by mocking unrealistic security wish lists and vendor pitches that ignore the people who must carry them out. He describes customers who wanted password audits despite having no password policy, and conditional MFA rules that system administrators would quickly work around. His point is that the workforce's skills and habits should shape any tooling decision before a purchase is made.

The middle of the talk covers his team's experience running a security operations center with nine analysts handling a very large daily event volume. He explains how a tool-by-tool, alert-driven workflow proved slow, and how the team rebuilt its process around first-principles questions, better detections and clearer automation. He also walks through insider threat patterns, where a small group causes most of the trouble and layoffs can trigger data theft, and compares the work to warehouse and ERP operations to argue for process-focused redesign.

He closes by separating analytics, machine learning and generative AI, and by urging teams to tie security improvements to business outcomes they can measure. The practical takeaway is that staffing, analyst onboarding time and workflow design matter as much as the product stack, and that new capabilities should be judged against concrete operational needs.