Engineering writing from the Quarry team.
Architecture decisions, latency budgets, and opinionated takes on where agentic SOC tooling is and where it's heading. No roadmap-as-blog-post; no marketing rewrite of a press release.
- operationsautonomymaturity-modelMay 13, 2026 · 11 min read
L0 → L4 SOC automation maturity, and where the industry actually is
The L0–L4 SOC automation maturity model defines five tiers by per-action blast radius, not by product capability. The full white paper is in the repo. This post is a working summary plus an opinionated read of where most SOCs actually sit in 2026 — and what it would take to move.
Prince Sinha, Senior Director, Innovations at CybleRead post - architecturelatencyagentsMay 13, 2026 · 12 min read
Latency budget for sub-minute investigation
Sub-minute end-to-end means a 30-second p50 budget split four ways: 5s context bundle, 5s parallel sub-agents, 10s LLM reasoning, 10s buffer. Here is how the AiSOC orchestrator spends it, what blows through it, and the substrate-level numbers behind the published north-star target.
Prince Sinha, Senior Director, Innovations at CybleRead post - architecturegraphingestMay 13, 2026 · 12 min read
Why agentic SOC needs a graph at ingest
The substrate the LLM agent reasons against decides everything downstream. We materialise the graph at ingest time — 17 node labels, 14 relationships, fixed schema, drift-gated in CI. Here is why row-store SIEM doesn't survive contact with an autonomous triage loop.
Prince Sinha, Senior Director, Innovations at CybleRead post
Want to write for the Quarry blog?
Send a one-paragraph pitch to hello@quarry.dev or open an issue on GitHub. We're especially interested in operator perspectives on gating autonomous response, agent latency tuning, and graph modelling at ingest time.