Why Your SOC Needs a Risk Operations Center (ROC)| Rich Seiersen, Qualys

Why Your SOC Needs a Risk Operations Center (ROC)| Rich Seiersen, Qualys

by Cloud Security Podcast · View the channel on PSI

Humanities, Social Sciences & Thought Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Cloud Security Podcast 👥 40K 📅 September 16, 2026 ⏱ 39 min 👁 493 📄 expert opinion 🧭 2026-09-17
Available in: English (current) Français

Keywords

CVEAWEhyper-prioritizationporosityautonomous remediation

Summary

This podcast episode features Ashish Rajan interviewing Rich Seiersen, Chief Risk Technology Officer at Qualys, about the shift from traditional vulnerability management to risk operations. Seiersen argues that the exponential growth of CVEs and AI-driven adversaries have reduced the mean time to weaponize to minus seven days prior to disclosure, while the average window of exposure (AWE) remains at 28 days for most enterprises. He advocates setting a new benchmark of a 24-hour mean time to remediate for critically exploitable assets, achieved through ‘hyper-prioritization’—filtering false noise by assessing reachability and exploitability—and using autonomous remediation to shrink the attack surface. The conversation introduces the concept of ‘porosity’ measured in instance-days of exposure and discusses how reducing both instance and time dimensions can dramatically lower risk. Seiersen emphasizes that building a Risk Operations Center (ROC) rather than a SOC focuses on prevention and controlling terrain, drawing analogies to Sun Tzu and asymmetric warfare. The episode also touches on identity and semantic risks in AI contexts, with practical advice for CISOs to benchmark their AWE against industry peers and leverage AI for patching decisions.

181 words

Critical Evaluation

Value of the Information & Strength of the Argument

The podcast delivers substantial practical value for cybersecurity practitioners, offering concrete metrics (AWE, MTTR, porosity) and a clear methodology for prioritizing vulnerabilities. Seiersen’s argumentation is structured logically: he establishes a quantitative baseline (28-day AWE) and contrasts it with the threat dynamics (weaponization at minus 7 days), then proposes a solution (24-hour MTTR via hyper-prioritization and automation). The use of examples like the 2,000 CVEs in one week and the analogy of controlling terrain adds persuasive weight. However, the claim that a 24-hour MTTR is a ’new floor’ is not substantiated by independent research, and the reliance on Qualys’ proprietary data limits external validation. The reasoning is coherent but sometimes overflows with rhetorical flourishes (e.g., ‘habachi of techniques’), which may detract from scientific rigor.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; Seiersen cites his own books and Qualys’ internal data without peer review. He references MITRE ATT&CK and MITRE ATLAS as frameworks, but does not provide detailed evidence for the ‘28-day AWE’ statistic. The title accurately reflects the content, which focuses exclusively on advocating a ROC paradigm. Sources mentioned in the description are all promotional links to the podcast’s own channels, not independent references. There are no cited external papers or authoritative sources within the dialogue, limiting the verifiability of key claims. The discussion is consistent with industry best practices but lacks the depth of a formal literature review or empirical study.

244 words

Title / Content Match

The title accurately captures the core thesis that traditional SOCs should evolve into Risk Operations Centers to manage modern exposure at machine speed.

Quality & Reliability

7/10

Rich Seiersen, a veteran CISO and risk practitioner, presents operational metrics (AWE, MTTR, porosity) supported by data from Qualys' exposure lake, but the discussion is largely anecdotal and not peer-reviewed; promotional bias toward Qualys products is evident.

Chapters

Cited Sources

Contribution & Novelties

The episode contributes a conceptual framework for shifting from reactive vulnerability management to proactive risk operations, introducing the ‘Risk Operations Center’ (ROC) as a successor to the SOC. It operationalizes the idea of ‘porosity’ as instance-days of exposure, providing a quantifiable metric to guide remediation priorities. The insistence on a 24-hour MTTR for critical exposures, backed by Qualys’ data, challenges common practice and pushes for machine-speed responses. The narrative also integrates AI-driven autonomous remediation and emphasizes reducing both instance and time dimensions of exposure, offering a refreshing angle on scaling security operations.

Pour aller plus loin :

  • MITRE ATT&CK — Comprehensive framework of adversary tactics and techniques, relevant to understanding exploitability and attack paths.
  • The Art of War (Wikipedia) — Sun Tzu’s classic military strategy, cited by Seiersen for ‘controlling the terrain’ in asymmetric defense.
  • Mean time to repair (Wikipedia) — General benchmark concept, analogous to MTTR in cybersecurity.

149 words

Radar Profile

The radar profile shows a balanced but moderate performance across all dimensions. Quantity and technical level are relatively high, reflecting the depth of practical details, while reliability and overall quality scores are slightly lower due to the lack of independent verification and promotional undertones. This suggests a useful practitioner-oriented discussion rather than a rigorous academic analysis.

Reliability 6/10