How AI Changed the SOC, Part 4: Analyst Rankings Are Not a Buying Signal

Do analyst rankings tell you anything worth knowing before you buy? A registrant put the contradiction to the panel directly: buyers say they will not buy from a startup because enterprises listen to Gartner, then say they are happy to buy AI for a year and switch if the company turns out to be a dud. Chris Jordan's answer is that a really good Gartner person picking top of the quadrant would have picked QRadar and watsonx, and that ArcSight, bought by a number of entities in South Africa, is the same story. What the quadrant gives you is marketing numbers, not consistency, and often a product that is about to be dead. His counter-model is Intuit against Microsoft Money: a small company can innovate every year, and the follower is always a year behind. The session closes on sovereignty, and on the part of it nobody audits: not just where the data sits, but who is reviewing it and where those analysts actually are.

Transcript

Patrick Evans: Gents, it's been a very interesting chat. We don't have many questions, but one of the people who registered this morning and said he will listen to the recording later did ask a question, and I'm going to pose the question to you. It's how people buy or choose not to buy. And this was something that came out of this person. They found that a lot of companies have started saying that buying from a startup — and you're not a startup, I know that, you've been going for 10, 12 years — but to a lot of people, you're not in the top right-hand corner of Gartner, and people in enterprises listen to Gartner.

So I'm going to let you allow Gartner into the answer. They then asked the same people the question, well, what about AI? Because AI is new. Everything is a startup. And the guy said, well, we don't mind buying AI for a year right now, and if it turns out the company's a dud who doesn't do a great product, or somebody better comes along, because it changes every week, we're quite happy to switch. And I found those two statements contrary to each other, and you're sitting on the crossroads of that, Chris, where you've built AI into your system, and that's changing regularly.

I've seen how much it's changed just in the last six months. In fact, since you were in South Africa in May. So maybe just comment on that, and then he will listen to the answer later on.

Chris Jordan: So there's two different stories that you can give. The first one is, let's talk about the Gartner analysis. So if you're a really good Gartner person, you pick top of the quadrant, you would have picked two products. One called QRadar, the other one called watsonx. I don't think I have to say much more. Literally. Okay, so everything—

Patrick Evans: One of the products here that they bought, and this is bought by a number of entities in South Africa, is ArcSight. So let's just throw that into the mix of three.

Chris Jordan: That's another one. Where's ArcSight today? But then the other story is, you say — my point is that if you think that you're getting consistency out of Gartner, you're lying. What you're getting is marketing numbers. And we all know that. And if I can go to Forrester, it's the same thing. But it really comes down to what else is it that makes something have longevity. And I think the best way to take a look at it is do another story.

That back in the late 90s, Microsoft came out with Microsoft Money. And everybody said, there's the end of Intuit. QuickBooks is done. We're done. How many people use Microsoft Money today? How many people use QuickBooks? So the interview to the Intuit CEO at the time said, how are you going to compete with Microsoft? And he said, it's really simple. We just innovate every year. Microsoft will always be following. And that's the same thing. Small companies can innovate, innovate, innovate.

But the reality is Microsoft can't. And that's the big difference between the two. I do love the one Charles is saying: SIEM is RIP. And that's true, by the way. I always say that it depends on what you wanted to talk about on a SIEM. I think that if you talk about the results, it's not dead. But if you talk about ArcSight and QRadar and database-oriented analysis, that is a doorknob. Okay? And this came out with Data Federations two years ago.

How many products support Data Federations? All the new startups do, which, by the way, Gartner doesn't give a crap about. But they love Cribl. Cribl went to Data Federations. We're in Data Federations. What does that mean? It means that I can take my telemetry data and store it in a place that's one-third cheaper and still search it. The thing is that staying ahead of technology is actually more important than buying in the top quadrant, because what you're buying in the quadrant is old.

You're buying something that's about to be dead. So if you want to know what's going to be dead, just look in the magic quadrant, and that's what's going to be dead. And I'll leave it at this. Business is a competition. So if you want the slowest horse and the slowest car, yeah, it's reliable. You're buying the tortoise. But unfortunately, right now, the tortoise is not winning.

Patrick Evans: There's one question that's come in. It's almost a cosmology question. Thank you, Henry and Chris. Chris, you mentioned data sovereignty and later the quality of the questions that need to be asked in terms of decision-making. Where do you perceive human sovereignty taking its place in this story?

Chris Jordan: That's a really good one. So a lot of times we think only about technology. And I think that the reality is that this is where you get back to small business and personal touch and MSSPs. That it's massively important that who's reviewing that data, where that data is being performed. And so sovereignty, not just from an infrastructure point, but a human infrastructure point, is just as important. And we go through the SOC 2. We do background checks and everything like that.

But again, I'm not validating that my guys aren't in India or the Philippines. And that's a big difference. So when Fluency delivers, we put an infrastructure for the data sovereignty, but the human sovereignty actually still is done by our MSSPs. And we like to choose MSSPs that are local. Now, we do have people in the United States who outsource to Africa because of the cost difference. So that does happen, like India and Philippines and stuff. But the reality, if you're really serious about data sovereignty, you would care where the people are too. Yep.

Patrick Evans: Thanks, Chris. So we brought coming to the end of time. I'd like to just pull a few threads together that came out today. The theme running through today has been simple but important. The SOC's value isn't the alert. It's the insight, the report, the decision it lets your business make. And when the pricing is straightforward and migration is low risk, that value becomes something you can actually plan around rather than fight against. Henry, you spoke today about the theory of turning a SOC into an insight-led center.

Would you be willing to come back for a follow-up session and walk us through how it actually has played out in practice — the real migration, the numbers, the outcomes your clients are seeing?

Henry Denner: If the price is right, I'll be happy to do so. It's worth a book. And the invoice. No, absolutely, Patrick. I'm happy to share. Yeah. Okay. I think maybe I can ask the questions. We'll let everybody know. Yeah.

Patrick Evans: So sincere thank you to Chris and Henry for such a candid conversation. And thanks to all of you for joining us, for giving us your time, especially those joining from the US and the UK. Okay. And if today sparked a question or an idea, please do reach out for us afterwards. If you have an idea for any follow-up webinars that you'd like us to host, please share that with us as well. Thank you. Thank you. Thank you. Thank you.

About the webinar

How AI Changed the SOC aired live on September 16, 2026. It was a conversation between Henry Denner of ASI Connect, who runs security operations on the managed services front line, and Chris Jordan, CEO of Fluency Security, moderated by Patrick Evans. The session set out to answer one question: what are you actually trying to achieve with a SOC? Across four parts it covers how AI changes detection and response, what an MSSP should deliver beyond closing tickets, how data pipelines and infrastructure shape cost and compliance, and how buyers should evaluate vendors.

This post is Part 4, Audience Questions. The transcript has been lightly edited for readability. Watch the full episode and the rest of the series on the Fluency Security YouTube channel, or book a demo to see how Fluency turns alerts into cases.