The Detection Model Is Upside-Down: EXPONENT 2026 Recap

At EXPONENT 2026, ReliaQuest CEO Brian Murphy argued that the traditional SIEM-centric SOC is too slow for modern attacker behavior and advocated re-architecting detection into three layers—at-source, in-transit, and storage—so agentic AI can orchestrate detection, investigation, and response in seconds; the article highlights GreyMatter Transit as an in-transit detection capability and recommends right-sizing or reducing reliance on SIEM for speed-critical use cases.