Monzy Merza (@monzymerza, CEO/Founder @Crogl) talks about build a next-generation Enterprise SOC by leveraging AI to stay ahead of Cybersecurity threats.

SHOW: 969

SHOW TRANSCRIPT: The Cloudcast #969 Transcript

SHOW VIDEO: https://youtube.com/@TheCloudcastNET 

CLOUD NEWS OF THE WEEK: http://bit.ly/cloudcast-cnotw

NEW TO CLOUD? CHECK OUT OUR OTHER PODCAST: "CLOUDCAST BASICS" 

SPONSORS:

• [Interconnected] Interconnected is a new series from Equinix diving into the infrastructure that keeps our digital world running. With expert guests and real-world insights, we explore the systems driving AI, automation, quantum, and more. Just search “Interconnected by Equinix”.
• [TestKube] TestKube is Kubernetes-native testing platform, orchestrating all your test tools, environments, and pipelines into scalable workflows empowering Continuous Testing. Check it out at TestKube.io/cloudcast

SHOW NOTES:

• Crogl website
• TechCrunch article
• Forbes Article
• Intellyx Article
• Last WatchDog Article

Topic 1 - Welcome to the show, Monzy. Give everyone a brief introduction and tell us about your unique journey from government research to Splunk to Databricks to founding Crogl.

Topic 2 - Let's start with the current state of cybersecurity and AI. We're seeing headlines about AI being the top cybersecurity concern for 2025, even overtaking ransomware. From your perspective, what's driving this shift and why should organizations be paying attention to the intersection of cybersecurity and AI?

Topic 3 - You've described Crogl as an "Iron Man suit" for security analysts. That's a compelling metaphor. Can you break down what you mean by that and how your approach differs from the traditional "reduce alerts" mentality that most vendors have been pushing?

Topic 4 - Let's talk about your "knowledge engine" and what you call an “AI for the Enterprise SOC”. You're using compound AI systems with LLMs, smaller models, and knowledge graphs. This sounds quite different from vendors who are just "bolting on" LLMs to existing tools. Walk us through this architectural decision and why it matters.

Topic 5 - The cybersecurity industry is experiencing massive alert fatigue - 4,500 alerts per day, with analysts only able to investigate 8-25 of them. Your philosophy is "every alert should be analyzed" rather than filtering them out. That seems counterintuitive to what the market has been doing. How does your autonomous investigation approach actually work in practice?

Topic 6 - Where do you see this evolution heading, and what are the implications for SOC teams and security practitioners? Are we heading toward fully autonomous SOCs?

FEEDBACK?

• Email: show at the cloudcast dot net
• Bluesky: @cloudcastpod.bsky.social
• Twitter/X: @cloudcastpod
• I