Building security operations from scratch and when MDR makes sense

Summary

In the inaugural episode of SecOps Confidential, host James Berthoty sits down with Patrick McKinney (VP of Security, Invisible) to explain how to build a SOC (Security Operations Center) and scale security operations as companies grow.

They break down when to move beyond CTO-owned security, how to approach tooling while building a SOC without overbuying, and how emerging AI SOC platforms can reduce operational burden while improving investigation speed and access to data.

Patrick shares practical guidance, including how to tie security spend to revenue retention, sales enablement, and risk, plus how to evaluate open-source vs. SaaS tools, vendor transparency, and the evolving landscape as AI reshapes security operations.

Show Notes

• Practical triggers for standing up a security operations program and moving beyond informal or CTO-owned security
• How to build a SOC incrementally without buying $500K worth of tools on day one
• How to justify security budget with revenue retention, sales cycle impact, and risk framing
• Open-source vs. SaaS tradeoffs when building an internal SOC, including operational overhead
• When (and whether) to off-board MDR as internal maturity grows
• Why AI SOC value is often analysis quality and investigation speed, not just headcount reduction
• What vendors can do to earn trust: transparency, proof, realistic promises, and fast time-to-value

Links

• Invisible
• Exaforce