Logs & Lattes: Episode 6 - How Small SOC Teams Stop Drowning in Alerts
Lean security teams don't need a smaller version of an enterprise SOC. They need a different approach entirely.
Graylog Director of Product Management, Rich Murphy, joins Logs and Lattes to explain why 2-to-4-person security teams are the most underserved segment in cybersecurity and what needs to change.
In this episode:
Why alert fatigue causes judgment erosion, not just burnout
Why credential compromise defeats rules-based detection
Why SOAR never delivered for small teams and what should replace it
How to support junior analysts without constant senior escalations
What CISOs on lean teams need to answer the board question "are we covered?"
This episode is for security analysts, SOC managers, IT directors, and CISOs at mid-market companies who are tired of tools built for 40-person SOCs.
Follow Graylog on LinkedIn and YouTube for more practitioner-focused conversations on security operations, threat detection, and incident response.
Learn more at graylog.org
0:00 Intro: The Reality of Lean Security Teams
0:54 What “Lean” Actually Means (Not a Small SOC)
2:19 The Daily Chaos & Reactive Workload
5:19 Alert Fatigue & Missing Real Threats
8:05 Attacks That Look “Normal”
10:25 Skill Gaps, Training & Tool Complexity
12:20 Making Junior Analysts More Effective
13:42 Why SOAR & Automation Fall Short
14:48 AI’s Role (What It Helps—and What It Doesn’t)
16:11 The CISO Perspective & Reporting Gaps
17:59 Transparency, Risk & Budget Conversations
19:22 Are Things Actually Getting Better?
20:39 Wrap-Up & Key Takeaways