Buying an AI SOC? Ask These 70 Questions First

A practical, vendor-neutral guide for CISOs, security leaders and practitioners evaluating AI SOC and agentic security operations products.

The guide presents 70 questions with explanations of what each question tests. Its 13 sections cover evidence, authority, failure handling, vendor claims and testing, speed and accuracy, correlation, supply chain, ransomware, data theft, movement between systems, cost, change management and exit.

It includes ten questions for a first vendor meeting, examples of what a good answer should establish, diagrams, proof-of-concept guidance and a printable meeting worksheet. The emphasis is on evidence that can be inspected, tested and retained, alongside the operational value and risk of the proposed product.

Written for CISOs, SOC leaders, detection engineers, incident responders, security architects, and procurement and risk teams. Guide version 1.12; 37 pages. A separate editable Excel worksheet, version 1.9, supports recording evidence and evaluation decisions.

Author: Jessen Kurien, cybersecurity leader, practitioner and author, with 18+ years in cybersecurity, including nearly 15 years at Microsoft in leadership and technical roles, SOC leadership at a global MSSP, and a consulting engagement supporting Cisco. Certifications: CISM; CISA; ISO/IEC 42001:2023 Lead Implementer; ISO/IEC 42001:2023 Lead Auditor.

Reuse: the guide is available under the custom permissions in LICENSE-GUIDE.txt. It is not licensed CC BY 4.0. The separate worksheet, including the questions reproduced in it, is licensed CC BY 4.0.

Read the web guide: https://www.jessenkurien.com/ai-soc-vendor-evaluation/