While Silicon Valley debates the latest cybersecurity buzzwords, teams in Manila, Phnom Penh, and across Southeast Asia are quietly revolutionizing how security operations actually work. What they've discovered might just solve the global cybersecurity talent crisis.

"Here in the Philippines, we reached the stage of talent drain," explains CJ, who manages sales for Human Managed. 

This brain drain creates a paradox: companies desperately need security talent, but skilled analysts migrate to higher-paying markets. The traditional response — throwing money at the problem or outsourcing to the lowest bidder — isn't working. But what if the solution isn't about finding more people? What if it's about fundamentally changing how security operations work?

From Alert Fatigue to Intelligent Automation

After 25 years in cybersecurity, industry veteran and founder of Human Managed, Saleem, identified a pattern that hadn't changed since he started: 

"It was always about the amount of alerts which an analyst will receive, and the burnouts, which the analyst has, and the lack of context."

Security analysts typically spend 15 minutes per report (manually)

Industry standard triage time: 2-6 hours for priority alerts

But young analysts in Cambodia are flipping this equation entirely.

"Before I was introduced to AI agents, we had to spend hours each night writing reports manually. With AI, one report that took 15 minutes now takes about 3 minutes," shares RT, a Cambodian security analyst. 

This isn't about AI replacing humans. As another analyst, Norak, learned: "AI is not replacing people, but it's replacing the people that not using AI."

What makes Southeast Asian teams particularly effective at this transformation? Three key factors emerge:

Hunger for Innovation. "We are curious people. We want to know stuff. We want to learn stuff," says Puthika, a Cambodian security analyst. "If it's new, we will try to catch up to other developed countries."

Practical Problem-Solving. Without access to expensive tools or large teams, these analysts learned to be resourceful. They're not wedded to traditional approaches because they never had the luxury of unlimited resources.

Global Collaboration. By working across time zones, languages, and cultures is their normal. As Tech from Cambodia notes: "We are always ready to hustle from anywhere. Doesn't matter what time."

The new SecOps approach emerging from Southeast Asia breaks down into four interconnected components:

1. Data Product: "We collect data, process it, and send meaningful results," explains Jesum, HM’s chief engineer. Not just alerts — contextualized intelligence.

2. Messaging Product: Real-time notifications that cut through noise, delivering only critical alerts based on business impact.

3. AI Product: Natural language interfaces allowing analysts to simply ask, "What are the top security threats that require my immediate attention?"

4. App Product: Unified dashboards providing context, not just alerts — showing who owns assets, what's affected, and business impact.

Time to Triage (P1): <30 minutes vs. industry standard 2-6 hours

False Positive Suppression: 40-60% reduction

Alert Context Coverage: >90% include asset context

But the real transformation isn't in the metrics — it's in the mindset shift from reactive to proactive security.

One of the most innovative aspects is explainability. As Saleem emphasizes: 

"How do you establish trust? Explain the work which you're actually doing. 

This is exactly where AI can come in and explain why a certain decision was made

This transparency transforms the traditional black-box approach to security operations into something stakeholders can understand and trust.

 Instead of fighting over the limited pool in developed markets, tap into emerging talent pools. The hunger and adaptability often outweigh experience.

Invest in Automation That Amplifies, Not Replaces. 

As teams discover: "Machine learning isn't always the answer. Sometimes simple rule-based methods win when interpretability and speed matter."

 More alerts don't equal better security. Enrichment and context turn noise into intelligence.

 Security stacks should adapt to your business, not the other way around. "We maintain our own platform... whatever their data sources, we have the skill sets to address that," notes Karen Kim, CEO of Human Managed.

The lesson from Southeast Asia is clear: the future of SecOps isn't about having more – more tools, more people, more budget. It's about 

While enterprises elsewhere debate AI's role in security, teams in emerging markets are already living it. They're not waiting for perfect conditions. They're building the future with curious minds, practical solutions, and a willingness to challenge conventional wisdom. 

Want to see this transformation in action? Watch Human Managed's complete SecOps series 

 featuring candid conversations with the engineers and analysts pioneering this approach.

Keywords: SecOps, Security Operations, Southeast Asia Tech, AI Security, Alert Fatigue, Cybersecurity Innovation, Distributed Teams

How distributed teams from Cambodia to the Philippines are pioneering the future of security operations

The Global Talent Crisis Reshaping Cybersecurity: Lessons from Southeast Asia's SecOps Revolution

Beyond Alert Fatigue: How a Data-First Approach Is Reshaping Security Operations

If you've spent any time in a Security Operations Center, you know the drill. Screens filled with alerts. Analysts context-switching between a dozen different dashboards. The constant, nagging question: is this one actually important?

Human Managed's founder Saleem has spent 25 years in the cybersecurity field, and his assessment is blunt: the fundamental challenges—alert volume, analyst burnout, lack of context—remain largely unsolved despite waves of new technology.

Most organizations approach security operations as a tool problem. When something breaks, buy new software. When alerts pile up, add another dashboard. When analysts burn out, hire more people.

The Human Managed team argues for treating security as a data problem instead. Rather than building yet another detection tool, we focused on how data flows through security operations—and where that flow breaks down.

CEO Karen Kim draws a distinction between traditional approaches that present data to humans versus making data the central player. The difference: front-loading analysis and contextual understanding so that by the time information reaches an analyst, the heavy lifting is already done.

There's a metric that rarely appears on security dashboards but might be the most important one: the gap between when something happens and when someone makes a decision about it.

Consider a practical example: file transfer monitoring. Uploading files to cloud storage is normal activity. But telemetry can reveal patterns—a user uploading to a non-organization-owned online drive. That's one data point.

Add context through automated enrichment: the user has elevated permissions, access to confidential data, and resigned a week ago.

The individual facts weren't alarming. The pattern—assembled automatically, enriched with context—absolutely is. And critically, this analysis happened in microseconds rather than hours of manual investigation.

Any system that automates triage decisions must establish credibility with analysts. The Human Managed approach uses AI not just for detection but to articulate why a decision was made. Statistical models handle pattern recognition and scoring. Language models communicate findings in human-readable form.

The messaging design also combats alert fatigue deliberately. New customers receive a baseline configuration filtering for only critical and high-severity alerts—because user research revealed that people who want everything become overwhelmed within days and stop checking entirely.

The platform demonstrates four-minute average triage times—compared to industry standards that often stretch to hours. Alerts arrive enriched with asset context, threat intelligence, and business impact assessments. AI provides not just severity scores but explanations and recommended actions.

The cybersecurity industry has spent decades building sophisticated detection capabilities while largely ignoring what happens after detection. Alert fatigue isn't a bug—it's the predictable outcome of prioritizing identification over action.

Twenty-five years is long enough to solve the same problems. The technology finally exists to do something different.

Want to see how Human Managed approaches SecOps differently? Check out the full video series 

 on the Human Managed YouTube Channel where team members walk through the platform, philosophy, and technical architecture behind modern security operations.

This article is written based all videos in our Secops video series.

A deep dive into why the cybersecurity industry's biggest challenges haven't changed in 25 years—and what's finally different now

At ISOG’s “I AM SECURE 2025” Forum, Human Managed CEO Karen Kim explored how human intelligence can inspire a new kind of AI-powered cybersecurity — one that’s truly primed for outcomes.

I've always found how our brains (and gut) works quite fascinating. Like when you're walking through a familiar area and yet something just feels off. You can't quite put your finger on it, but your brain is screaming that something's not right.

That's priming at work. Your brain is constantly taking fragments of memory, experience, and knowledge, then mashing them together to make split-second judgments about new situations. It's what makes human intelligence so powerful, and so frustratingly hard to replicate in machines.

This disconnect between human intuition and machine capability was at the heart of our CEO Karen Kim's recent keynote at the ISOG Forum 3 (I AM SECURE 2025) event, where she unpacked this question: 

How do we build autonomous security operations that actually work?

Thekeynote opens with a thought experiment that perfectly captures the priming problem.

“Imagine walking down a street in Makati and seeing a Jollibee—but instead of the cheerful bee mascot, Ronald McDonald is standing there. There's a green car parked out front, doors wide open, completely empty.”

Your brain would immediately flag this as suspicious. Not because any single element is inherently dangerous, but because the combinationdoesn't fit your mental model of how the world should work. That's priming in action.

“This is what human intelligence is all about. It’s what makes us so powerful,”

But while humans excel at judgment, reflection, and emotion, our intuition is also biased and inconsistent. Machines, on the other hand, are the opposite — consistent, fast, and tireless, yet blind to context.

And that, according to Karen, is the challenge modern cybersecurity faces today.

In today’s hyper-connected environments, cybersecurity teams are overwhelmed — billions of alerts, overlapping data streams, and constant fatigue. Relying solely on either humans or machines is no longer enough.

“Modern security operations cannot succeed without machines being primed for outcomes,”

This means going beyond automation for automation’s sake. It’s not about feeding machines more data; it’s about teaching them to interpret, contextualize, and act the way humans do — but at scale and without bias.

Six Intelligence Blocks: Teaching Machines to Prime

Instead of building one massive AI solution,we took a page from how human intelligence actually works.Each part of the system represents a different kind of “intelligence,” working in parallel toward specific outcomes:

Discover – Uses linguistic and spatial intelligence to map and understand the environment.

Detect – Leverages numeric and sensory intelligence to spot anomalies and shifts from baseline.

Profile – Builds emotional and reflective intelligence by assessing asset trust and behavioral patterns.

Triage – Combines numeric and reflective intelligence to prioritize and reduce noise.

React – Informs reflective intelligence to determine the best next steps.

Resolve – Uses emotional intelligence to assign response actions with confidence and context.

Together, these blocks form what Karen described as “autonomous SecOps” — not a single, monolithic AI, but a network of specialized models that mirror how humans think, feel, and decide.

“Autonomous SecOps is not about creating one giant solution. It’s about creating specialized models, each primed for a specific input, process, and output.”

As cybersecurity leaders rush to adopt AI, the key takeaway from Karen’s keynote is clear: AI should not replace human judgment — it should be trained by it.

By blending human intuition with machine consistency, organizations can move toward truly intelligent SecOps — one that’s proactive, context-aware, and outcome-driven.

“At Human Managed, we are not only building (autonomous SecOps) — we are running it today.”

If there's one thing I took away from both the keynote and conversations at ISOG Forum 3, it's this: The future of cybersecurity isn't about choosing between human intuition and machine processing. It's about training machines to prime: to combine fragments of context into meaningful judgmentso that when human and machine intelligence come together, we achieve something neither could alone.

When humans and machines learn from each other, cybersecurity transforms from reactive firefighting to a living, learning system — one that’s always a step ahead.

Want to dive deeper into how these six intelligence blocks work together? 

Watch Karen's full keynote from ISOG Forum 3

, where she breaks down each model with real-world examples of autonomous SecOps in action.

When Machines Learn to Prime: Rethinking Autonomous Security Operations 

For decades, true security operations (SecOps) were the privilege of large enterprises. As Karen Kim, CEO of Human Managed, explains:

“Traditionally, security operations were only available to companies with the resources—the access to technology, teams, and skill set. But now … the barrier to entry to having 24/7 SecOps has been removed.”

“SecOps stands for Security Operations. SecOps as a whole is a series of processes put together to protect an environment, to protect the enterprise.”

 The purpose is simple: ensure alerts are prioritized, understood, and resolved before they escalate into crises.

This creates bottlenecks. As Karen notes, 

“Sometimes they don’t even have enough resources that can analyze and do something about these alerts.”

breaking down security operations into micro-decisions

. By integrating AI, repetitive triage decisions can be fast-tracked, freeing human teams to focus on strategy and higher-order threats.

“Because we have gathered this knowledge of how decisions are being taken in a cybersecurity context, we’re able to work with AI to build, you know, fast track some of the decisions.”

For executives leading digital transformation, this is more than an IT upgrade. It’s about ROI and resilience:

Improved visibility into business-critical risks

Faster response cycles that protect brand and compliance

In short, 24/7 security is no longer gated by budget or team size. As Karen puts it: 

“Build knowledge, capture knowledge, make it reusable. Don’t do the same things over and over again.”

This article is based on the first installment of our new 

, where Karen Kim introduces what SecOps is and why it matters.

In the next episodes, we’ll dive deeper into:

, showing how decisions are automated and scaled.

If you want to see how SecOps can transform your organization, stay tuned for the 

Why the Barrier to 24/7 Security Operations No Longer Exists 

This bootstrapped data platform has been profitable for six years without a cent of VC funding. But the real story isn't about the company—it's about the people who built it. After 10 episodes of conversations with the team at Human Managed, we learned not just how to build resilient security operations, but also how to build meaningful careers in tech without following a straight line.

1. The Degree That Got You Here Won’t Define Where You Go

From aerospace engineering to Kubernetes administrator. From linguistics PhD to design ops lead. From physics major to front-end engineer.

The career paths inside Human Managed aren’t just unconventional — they’re a feature, not a bug.

As Wei Xiong Lee, now a cloud architect, put it: 

“Your diploma at 18 doesn’t define your career at 28.”

His path was paved by two hours of nightly self-study, certifications earned on the side, and the willingness to adapt.

That theme repeats across the team: diverse backgrounds became competitive advantages. Different ways of thinking — systems from physics, language patterns from linguistics, precision from aerospace — enriched how they built, designed, and solved problems.

 skills can be taught. Attitude, initiative, and perspective are harder to find. Hire for curiosity and ownership, not just credentials.

Every enterprise collects more data than it knows what to do with. The real challengeisn’t storage — it’s meaning.

“You still have to tie it back to what the business needs. You have to tie it back to what problems you are solving.”

This insight hit home for regulated industries like finance and healthcare, where compliance gaps often come from data mismatches. Dashboards may look complete, but what’s captured in the system doesn’t always match reality.

 measure ROI not by how much data you collect, but by how effectively that data answers critical business questions.

3. AI Won’t Replace You — But Colleagues Who Use It Might

AI showed up in almost every episode, but not in the way you expect.

“AI is a tool that needs to be guided by humans to produce the best results.”

Adam Spiers, our Lead AI Engineer, built a framework he calls 

Human Learning Through Machine Learning (HLTML) 

— a reminder that the goal isn’t replacement, but amplification.

“The person who uses AI won’t be replaced. The person who doesn’t will be,”

“AI can feel like a team of 50 — but you still have to validate every output,”

“Don’t spend months learning tools. Learn in a week and move forward,” 

 the advantage isn’t in mastering one tool — it’s in continuously adapting to new ones while keeping your fundamentals sharp.

4. Build Systems Like Lego, Not Monuments

Technology stacks grow old fast. The difference between adaptable and obsolete often comes down to architecture.

“Think Lego blocks. The ones from 30 years ago still work with the blocks today.”

That modular, composable approach has saved Human Managed from costly rewrites, while enabling them to adopt new technologies quickly. Combined with a multi-cloud strategy (AWS, Azure, and GCP), the company avoided vendor lock-in and gained resilience.

 invest in platforms that evolve without forcing reinvention. Backward compatibility isn’tjust good engineering — it’s good economics.

You can buy tools. You can’t buy initiative.

Grace Salazar, our Community Ops Officer, 

“Skills can be developed, but attitude is hard.”

Human Managed runs distributed teams across Singapore, Manila, and India, blending graduates, interns, and experienced experts. The flat structure means interns can challenge senior engineers — and sometimes they’re right. That dynamic fuels innovation faster than hierarchy ever could.

 the best defense isn’t just technology, but a culture of ownership where people feel empowered to act.

Finally, there’s the matter of money. That is tied to value generated, not borrowed. In an industry where startups raise millions before shipping a product, Human Managed chose to stay bootstrapped. 

 explained Director of Operations Roshanara Basheerudin. Every dollar had to be tied to customer value — not vanity metrics.

That constraint became a discipline: build modular, stay multi-cloud, prioritize explainability, and keep customers at the center.

 constraints sharpen focus. And for enterprises choosing vendors, profitability is often a better signal of resilience than investor decks.

Final Thoughts: Technology Is Still Human-Centered

 series wasn’t about data pipelines, AI models, or cloud strategies. It was about 

Whether it was fraud detection models that highlight anomalies but rely on humans to interpret them, or engineers rewriting code eight times to get it right, the pattern was clear: technology scales what people imagine, but it doesn’t replace their judgment.

That’s why “Humans in the Loop” wasn’t just a series title. It was the philosophy that’s kept our bootstrapped company profitable while venture-backed peers stumbled.

For enterprises, the lessons are straightforward:

Because the future of cybersecurity won’t belong to those with the biggest budgets. It will belong to those who put humans — their judgment, creativity, and initiative — at the center.

👉 What challenges has your organization faced in balancing security investments with measurable business outcomes? 

Watch all 10 episodes of Humans in the Loop to hear these stories firsthand.

What 10 Episodes of "Humans in the Loop" Taught Us 

Digital transformation may sound like a buzzword, but it has become a business imperative. Across industries, companies are under pressure to improve efficiency, scale effectively, meet rising customer expectations and keep pace with evolving regulations—all of which demand leading-edge technology.

Yet urgency alone isn’t enough. Without cultural alignment, strong governance and a clear purpose, technology upgrades rarely deliver lasting results. Below, members of 

 share strategies and policies that can help organizations turn digital transformation into measurable business impact.

1. Align Technology Change With Cultural Change

One key factor is aligning technology change with cultural change. When leaders invest in clear communication, reskilling and stakeholder buy-in alongside new tools, digital transformation moves from being an IT project to an organizational success. - 

Digital transformation is urgent, but starting points are often unclear. Whether it’s the leadership team (CEO, CFO or CTO), deadlines, regulations or external market forces, something’s always altering plans. However, quick investments in AI for automation efficiency or fraud detection can save millions. During ERP rollouts, infrastructure modernization ensures continuity, justifying the investment despite external factors. - 

One key factor is making data the core of the transformation—not just software or infrastructure. Success comes when teams invest in foundational data work: defining schema, ontologies, metadata, features and labels. This makes downstream automation, AI and decision workflows truly scalable and adaptive. - 

4. Use AI At The Edge For Transparency And Control

AI is the ultimate digital transformation. AI at the edge isn’t just smart—it’s empowering. With real-time insights and remote control, industries gain visibility, agility and confidence like never before. AI transparency moves us from “what you don’t know can hurt you” to “what you understand can empower you.” AI at the edge provides greater transparency and control of remote sites. - 

5. Align Technology With Operational Needs

In my experience, digital transformation succeeds when technology serves a clear operational need. For example, in high-speed digital semiconductor testing, aligning engineering and operations early was critical. Cross-functional teams ensured new tools delivered real performance gains (increased throughput, higher yields and improved quality), and that drove lasting impact across the organization. - 

6. Build Trust Through Collaborative Development

The key factor for us is always collaborative testing, joint application development sessions with the various lines of business, and understanding upstream and downstream impacts that the automation brings. The successful outcomes of our latest digital transformation project had a lot to do with trust in delivering quality and in each other as a unified team. - 

Start with what customers truly need, not what you offer. Appreciate the plurality of their needs and segment them into the top three priorities. Focus on delivering outcomes that help them succeed and democratize access to value. - 

Digital transformation cannot be successful unless it’s focused on the user. Focusing on user experience, getting iterative feedback and improving are the most critical strategies in all digital transformation successes. - 

9. Secure Commitment From Executive Leadership

Serious commitment from executive leadership is essential. Successful digital transformation requires a clear and compelling vision, as well as adequate resources to drive the change needed to achieve measurable outcomes over time. - 

10. View Transformation As A Strategic Shift

One key factor in successful digital transformation is viewing it as a strategic shift, not just a tech upgrade. In the travel space, we’ve seen the biggest wins when companies combine AI and automation with real changes in how frontline teams work—that is, when teams are empowered to make faster, more confident decisions (even under pressure) and when complex, repetitive tasks are automated. - 

11. Engage Stakeholders With A Clear End Goal

Start with the motivating purpose and target end goal to engage all stakeholders who will be affected by, and can help enable, the transformation. A systems approach combined with clear communication focused on the end goal ensures coordinated, collective change management. - 

12. Fuel Change With A Genuine Desire To Improve

The biggest driver of digital transformation is a genuine desire for change. When people feel the status quo is no longer acceptable, that motive power fuels vision, capabilities and roadmaps—and creates not just growth, but also meaning in work. I have come to believe transformations launched by mandate stall; those fueled by desire endure. - 

Remember the Pareto Principle. Here’s digital transformation’s 80/20 truth: Success isn’t about 100% tech adoption, but 80% of impact coming from 20% of strategic changes. Empower the 20% of change-makers and prioritize the 20% of initiatives that truly move the needle. It’s about smart focus, not exhaustive effort. - 

In every successful digital transformation I have seen, the real differentiator was designing systems for adaptability instead of just delivery. When platforms are modular and governance-driven, they evolve, turning transformation into a lasting capability rather than a one-time project. - 

15. Establish A Governance Framework From The Outset

One key factor in delivering a successful digital transformation is establishing a clear data and technology governance framework from the outset. Transformation initiatives often fail not because of the technology itself, but because of fragmented ownership, unclear accountability and lack of trust in data. - 

Garbage in, garbage out. I’ve seen that successful digital transformation really depends on starting with clean, reliable data and a clear view of your goals. You can have the best algorithms in the world, but if you’re feeding them junk, you’ll just make bad decisions at scale. Clean up the data first, then choose the tool that meets your needs. The sequence matters. - 

Quick wins are essential. A clear vision is critical for any initiative, but great ideas die quickly in the face of daily demands in today’s lean organizational models. Maintaining focus for extended periods of time on any initiative is tough. Bite-sized, tangible successes achieved with a focused and protected team build momentum, energy and credibility, which in turn create more interest and engagement. - 

18. Connect Technology Outcomes To People Outcomes

Successful transformation happens when technology outcomes connect directly to people outcomes. I was part of a project in which redesigning data pipelines that served more than 7 million digital users not only saved $1.5 million in cloud costs, but also gave customers faster, more reliable experiences. Anchoring change in both efficiency and human impact is what makes transformation stick. - 

The most overlooked factor in digital transformation is building for complexity from day one. Too many initiatives fail because they stitch together tools that don’t scale. The most successful transformations I’ve seen have embedded automation and intelligence into core workflows—so systems don’t just digitize processes, they adapt and improve as the business evolves. - 

20. Align Data And AI Strategy With Business Priorities

Digital transformation can stall without clear priorities. Data and AI help align stakeholders by identifying friction points like invoice disputes or fulfillment delays and correlating them to root causes, such as complexity in product or pricing structures. The takeaway: Aligning your data and AI strategy with your broader digital strategy doesn’t just support transformation—it accelerates it. - 

 offer firsthand insights on tech & business.

This article was originally published on 

20 Keys To Driving Successful Digital Transformation

In today's AI-first world, most organizations are racing to implement large language models and expand their compute capacity. Yet the fundamental question leaders should ask themselves and their teams is: If you could restart your AI journey with everything you know now, what would you do differently?

At Human Managed, our path began with data and analytics before evolving into an intelligence platform. This evolution revealed a consistent truth: AI's greatest challenge isn't technical complexity—it's organizational clarity.

Artificial Intelligence Index Report 2025

 by AWS, while AI investment rebounded and AI is becoming a central driver of business value, most companies are still early in their AI journeys. About half of organizations using AI in key functions report cost savings or revenue gains, but these benefits are often modest—typically less than 10% cost savings or under 5% revenue increase. This indicates that although AI is delivering financial impact, the scale of value is still generally low for most companies.

I believe that the gap exists because most are investing in compute and models without restructuring how decisions flow through their organization. Here are four principles to transform your approach:

Most AI initiatives start with technology selection rather than decision mapping. The 

Categories

Recent

The Global Talent Crisis Reshaping Cybersecurity: Lessons from Southeast Asia's SecOps Revolution

Beyond Alert Fatigue: How a Data-First Approach Is Reshaping Security Operations

When Machines Learn to Prime: Rethinking Autonomous Security Operations

Why the Barrier to 24/7 Security Operations No Longer Exists

What 10 Episodes of "Humans in the Loop" Taught Us

20 Keys To Driving Successful Digital Transformation

Building True Enterprise Intelligence: Beyond Models And Compute

Proven Product Design Strategies Cybersecurity Teams Should Adopt

Learn How AI is Revolutionizing Business Decision-Making - EP 365 - Karen Kim