While Silicon Valley debates the latest cybersecurity buzzwords, teams in Manila, Phnom Penh, and across Southeast Asia are quietly revolutionizing how security operations actually work. What they've discovered might just solve the global cybersecurity talent crisis.

"Here in the Philippines, we reached the stage of talent drain," explains CJ, who manages sales for Human Managed. 

This brain drain creates a paradox: companies desperately need security talent, but skilled analysts migrate to higher-paying markets. The traditional response — throwing money at the problem or outsourcing to the lowest bidder — isn't working. But what if the solution isn't about finding more people? What if it's about fundamentally changing how security operations work?

From Alert Fatigue to Intelligent Automation

After 25 years in cybersecurity, industry veteran and founder of Human Managed, Saleem, identified a pattern that hadn't changed since he started: 

"It was always about the amount of alerts which an analyst will receive, and the burnouts, which the analyst has, and the lack of context."

Security analysts typically spend 15 minutes per report (manually)

Industry standard triage time: 2-6 hours for priority alerts

But young analysts in Cambodia are flipping this equation entirely.

"Before I was introduced to AI agents, we had to spend hours each night writing reports manually. With AI, one report that took 15 minutes now takes about 3 minutes," shares RT, a Cambodian security analyst. 

This isn't about AI replacing humans. As another analyst, Norak, learned: "AI is not replacing people, but it's replacing the people that not using AI."

What makes Southeast Asian teams particularly effective at this transformation? Three key factors emerge:

Hunger for Innovation. "We are curious people. We want to know stuff. We want to learn stuff," says Puthika, a Cambodian security analyst. "If it's new, we will try to catch up to other developed countries."

Practical Problem-Solving. Without access to expensive tools or large teams, these analysts learned to be resourceful. They're not wedded to traditional approaches because they never had the luxury of unlimited resources.

Global Collaboration. By working across time zones, languages, and cultures is their normal. As Tech from Cambodia notes: "We are always ready to hustle from anywhere. Doesn't matter what time."

The new SecOps approach emerging from Southeast Asia breaks down into four interconnected components:

1. Data Product: "We collect data, process it, and send meaningful results," explains Jesum, HM’s chief engineer. Not just alerts — contextualized intelligence.

2. Messaging Product: Real-time notifications that cut through noise, delivering only critical alerts based on business impact.

3. AI Product: Natural language interfaces allowing analysts to simply ask, "What are the top security threats that require my immediate attention?"

4. App Product: Unified dashboards providing context, not just alerts — showing who owns assets, what's affected, and business impact.

Time to Triage (P1): <30 minutes vs. industry standard 2-6 hours

False Positive Suppression: 40-60% reduction

Alert Context Coverage: >90% include asset context

But the real transformation isn't in the metrics — it's in the mindset shift from reactive to proactive security.

One of the most innovative aspects is explainability. As Saleem emphasizes: 

"How do you establish trust? Explain the work which you're actually doing. 

This is exactly where AI can come in and explain why a certain decision was made

This transparency transforms the traditional black-box approach to security operations into something stakeholders can understand and trust.

 Instead of fighting over the limited pool in developed markets, tap into emerging talent pools. The hunger and adaptability often outweigh experience.

Invest in Automation That Amplifies, Not Replaces. 

As teams discover: "Machine learning isn't always the answer. Sometimes simple rule-based methods win when interpretability and speed matter."

 More alerts don't equal better security. Enrichment and context turn noise into intelligence.

 Security stacks should adapt to your business, not the other way around. "We maintain our own platform... whatever their data sources, we have the skill sets to address that," notes Karen Kim, CEO of Human Managed.

The lesson from Southeast Asia is clear: the future of SecOps isn't about having more – more tools, more people, more budget. It's about 

While enterprises elsewhere debate AI's role in security, teams in emerging markets are already living it. They're not waiting for perfect conditions. They're building the future with curious minds, practical solutions, and a willingness to challenge conventional wisdom. 

Want to see this transformation in action? Watch Human Managed's complete SecOps series 

 featuring candid conversations with the engineers and analysts pioneering this approach.

Keywords: SecOps, Security Operations, Southeast Asia Tech, AI Security, Alert Fatigue, Cybersecurity Innovation, Distributed Teams

How distributed teams from Cambodia to the Philippines are pioneering the future of security operations

The Global Talent Crisis Reshaping Cybersecurity: Lessons from Southeast Asia's SecOps Revolution

Beyond Alert Fatigue: How a Data-First Approach Is Reshaping Security Operations

If you've spent any time in a Security Operations Center, you know the drill. Screens filled with alerts. Analysts context-switching between a dozen different dashboards. The constant, nagging question: is this one actually important?

Human Managed's founder Saleem has spent 25 years in the cybersecurity field, and his assessment is blunt: the fundamental challenges—alert volume, analyst burnout, lack of context—remain largely unsolved despite waves of new technology.

Most organizations approach security operations as a tool problem. When something breaks, buy new software. When alerts pile up, add another dashboard. When analysts burn out, hire more people.

The Human Managed team argues for treating security as a data problem instead. Rather than building yet another detection tool, we focused on how data flows through security operations—and where that flow breaks down.

CEO Karen Kim draws a distinction between traditional approaches that present data to humans versus making data the central player. The difference: front-loading analysis and contextual understanding so that by the time information reaches an analyst, the heavy lifting is already done.

There's a metric that rarely appears on security dashboards but might be the most important one: the gap between when something happens and when someone makes a decision about it.

Consider a practical example: file transfer monitoring. Uploading files to cloud storage is normal activity. But telemetry can reveal patterns—a user uploading to a non-organization-owned online drive. That's one data point.

Add context through automated enrichment: the user has elevated permissions, access to confidential data, and resigned a week ago.

The individual facts weren't alarming. The pattern—assembled automatically, enriched with context—absolutely is. And critically, this analysis happened in microseconds rather than hours of manual investigation.

Any system that automates triage decisions must establish credibility with analysts. The Human Managed approach uses AI not just for detection but to articulate why a decision was made. Statistical models handle pattern recognition and scoring. Language models communicate findings in human-readable form.

The messaging design also combats alert fatigue deliberately. New customers receive a baseline configuration filtering for only critical and high-severity alerts—because user research revealed that people who want everything become overwhelmed within days and stop checking entirely.

The platform demonstrates four-minute average triage times—compared to industry standards that often stretch to hours. Alerts arrive enriched with asset context, threat intelligence, and business impact assessments. AI provides not just severity scores but explanations and recommended actions.

The cybersecurity industry has spent decades building sophisticated detection capabilities while largely ignoring what happens after detection. Alert fatigue isn't a bug—it's the predictable outcome of prioritizing identification over action.

Twenty-five years is long enough to solve the same problems. The technology finally exists to do something different.

Want to see how Human Managed approaches SecOps differently? Check out the full video series 

 on the Human Managed YouTube Channel where team members walk through the platform, philosophy, and technical architecture behind modern security operations.

This article is written based all videos in our Secops video series.

A deep dive into why the cybersecurity industry's biggest challenges haven't changed in 25 years—and what's finally different now

At ISOG’s “I AM SECURE 2025” Forum, Human Managed CEO Karen Kim explored how human intelligence can inspire a new kind of AI-powered cybersecurity — one that’s truly primed for outcomes.

I've always found how our brains (and gut) works quite fascinating. Like when you're walking through a familiar area and yet something just feels off. You can't quite put your finger on it, but your brain is screaming that something's not right.

That's priming at work. Your brain is constantly taking fragments of memory, experience, and knowledge, then mashing them together to make split-second judgments about new situations. It's what makes human intelligence so powerful, and so frustratingly hard to replicate in machines.

This disconnect between human intuition and machine capability was at the heart of our CEO Karen Kim's recent keynote at the ISOG Forum 3 (I AM SECURE 2025) event, where she unpacked this question: 

How do we build autonomous security operations that actually work?

Thekeynote opens with a thought experiment that perfectly captures the priming problem.

“Imagine walking down a street in Makati and seeing a Jollibee—but instead of the cheerful bee mascot, Ronald McDonald is standing there. There's a green car parked out front, doors wide open, completely empty.”

Your brain would immediately flag this as suspicious. Not because any single element is inherently dangerous, but because the combinationdoesn't fit your mental model of how the world should work. That's priming in action.

“This is what human intelligence is all about. It’s what makes us so powerful,”

But while humans excel at judgment, reflection, and emotion, our intuition is also biased and inconsistent. Machines, on the other hand, are the opposite — consistent, fast, and tireless, yet blind to context.

And that, according to Karen, is the challenge modern cybersecurity faces today.

In today’s hyper-connected environments, cybersecurity teams are overwhelmed — billions of alerts, overlapping data streams, and constant fatigue. Relying solely on either humans or machines is no longer enough.

“Modern security operations cannot succeed without machines being primed for outcomes,”

This means going beyond automation for automation’s sake. It’s not about feeding machines more data; it’s about teaching them to interpret, contextualize, and act the way humans do — but at scale and without bias.

Six Intelligence Blocks: Teaching Machines to Prime

Instead of building one massive AI solution,we took a page from how human intelligence actually works.Each part of the system represents a different kind of “intelligence,” working in parallel toward specific outcomes:

Discover – Uses linguistic and spatial intelligence to map and understand the environment.

Detect – Leverages numeric and sensory intelligence to spot anomalies and shifts from baseline.

Profile – Builds emotional and reflective intelligence by assessing asset trust and behavioral patterns.

Triage – Combines numeric and reflective intelligence to prioritize and reduce noise.

React – Informs reflective intelligence to determine the best next steps.

Resolve – Uses emotional intelligence to assign response actions with confidence and context.

Together, these blocks form what Karen described as “autonomous SecOps” — not a single, monolithic AI, but a network of specialized models that mirror how humans think, feel, and decide.

“Autonomous SecOps is not about creating one giant solution. It’s about creating specialized models, each primed for a specific input, process, and output.”

As cybersecurity leaders rush to adopt AI, the key takeaway from Karen’s keynote is clear: AI should not replace human judgment — it should be trained by it.

By blending human intuition with machine consistency, organizations can move toward truly intelligent SecOps — one that’s proactive, context-aware, and outcome-driven.

“At Human Managed, we are not only building (autonomous SecOps) — we are running it today.”

If there's one thing I took away from both the keynote and conversations at ISOG Forum 3, it's this: The future of cybersecurity isn't about choosing between human intuition and machine processing. It's about training machines to prime: to combine fragments of context into meaningful judgmentso that when human and machine intelligence come together, we achieve something neither could alone.

When humans and machines learn from each other, cybersecurity transforms from reactive firefighting to a living, learning system — one that’s always a step ahead.

Want to dive deeper into how these six intelligence blocks work together? 

Watch Karen's full keynote from ISOG Forum 3

, where she breaks down each model with real-world examples of autonomous SecOps in action.

When Machines Learn to Prime: Rethinking Autonomous Security Operations 

For decades, true security operations (SecOps) were the privilege of large enterprises. As Karen Kim, CEO of Human Managed, explains:

“Traditionally, security operations were only available to companies with the resources—the access to technology, teams, and skill set. But now … the barrier to entry to having 24/7 SecOps has been removed.”

“SecOps stands for Security Operations. SecOps as a whole is a series of processes put together to protect an environment, to protect the enterprise.”

 The purpose is simple: ensure alerts are prioritized, understood, and resolved before they escalate into crises.

This creates bottlenecks. As Karen notes, 

“Sometimes they don’t even have enough resources that can analyze and do something about these alerts.”

breaking down security operations into micro-decisions

. By integrating AI, repetitive triage decisions can be fast-tracked, freeing human teams to focus on strategy and higher-order threats.

“Because we have gathered this knowledge of how decisions are being taken in a cybersecurity context, we’re able to work with AI to build, you know, fast track some of the decisions.”

For executives leading digital transformation, this is more than an IT upgrade. It’s about ROI and resilience:

Improved visibility into business-critical risks

Faster response cycles that protect brand and compliance

In short, 24/7 security is no longer gated by budget or team size. As Karen puts it: 

“Build knowledge, capture knowledge, make it reusable. Don’t do the same things over and over again.”

This article is based on the first installment of our new 

, where Karen Kim introduces what SecOps is and why it matters.

In the next episodes, we’ll dive deeper into:

, showing how decisions are automated and scaled.

If you want to see how SecOps can transform your organization, stay tuned for the 

Why the Barrier to 24/7 Security Operations No Longer Exists 

Machine stories are about machines. Period. No drama, suspense or fantasy — just plain simple machines, and how they work. To get this started, the simple machine that humans think of are complex is what will be covered in this story. The computer!

This story is part of a trilogy which takes us through this simple machine's journey.

Computers are not magical. Yes they can beat humans in chess, go, or jeopardy, but it is not a mysterious being that can do multiple things at the same time. It’s just a simple machine no different than a light switch and can only do a very few things: it’s just that they are incredibly fast and tiny. They are good at doing specific simple things one after another in an orderly sequence as they are told in a consistent manner without getting bored. No questions asked!

If their specific simple task is to ask questions, then questions will be asked. A computer’s super power is its speed, not complexity.

Computers work on electricity and electricity travels at the speed of light, which is around 299,792 kilometres per second. Electricity travels through wires at around 1/100th the speed of light due to the weight of the electron streams. So it would take approximately 2 minutes to turn on a light bulb in the moon connected by a long pair of wire from earth. This speed allows a google search result to be returned in a fraction of a second. Hence the human’s obsession with the computer since they prefer their search result displayed instantly, not mailed to them a few days later.

What a computer can do hasn’t changed since it’s birth (1940). It still does the same few simple things, except that it has gotten faster, tinier, and cheaper.

 They are made of a few parts with a specific mission combined together to form a machine that helps humans.

Computers operate in binary and only understands two possible states: “on” and “off”, which is called a bit. The bits in a computer either has electricity (on) or not(off). There is no gray area. The only thing that has to move in a computer is electricity and the flow of this electricity is controlled by transistors (diagram below). The only decision this machine takes is to turn “off” or “on”, very similar to a light switch!.

How a machine works is usually understood by looking inside it. Different chips, plugged into a board is what can be seen if a computer is opened. Yes! looks can be deceiving, unlike a mechanical machine, staring inside a computer either gives you a headache or itchy red eyes (if you're allergic to dust) but the electric signal travelling through these chips cannot be seen.

In order to make it simple for humans, the parts of the computer made with these chips are characterized by giving them a name and its own symbol. These parts are connected into something else that also gets a name and another symbol. It keeps going until its done and the name given to the final product is "computer" and the symbol somewhat looks like this --> 💻.

Today’s computers use billions of tiny transistors to perform calculations by forming basic logic components called gates (not the founder of Microsoft) and it symbols are represented below.

The basis for computer logic was formed by George Boole a long time ago (1851-1864), which helps computers form an opinion (true / false) on the inputs presented to it. A logic gate might sound complex, but it is a simple electric circuit with two inputs and an output. It receives two incoming electric currents, compares them, and decides to generate a new outgoing electric current depending on the truth it finds. The most common gates called AND, OR, NOT, XOR (Exclusive Or), NAND (NOT AND), and NOR (NOT OR). A logic gate is like an admission office to a school that enforces these simple rules:

 Student admitted if excellent grades in Math and Science

 Student admitted if excellent grades in Math or Science or both

 Student admitted if excellent grades in Math or Science but not both

Student neither good in Math or Science but excellent in sports

Gates are the only thing that is required to build a computer, but a lot of them have been wired together to make something purposeful. One or more NAND gates is what makes a computer do what it could. Typically, standard logic gates are available in 14 pin or 16 pin DIL (dual in line) chips.

The TTL 7400 chip, containing four NANDs. The two additional pins supply power (+5 V) and connect the ground


By Audrius Meskauskas - Used GFDL images from 

Most complex math operations such as addition, subtraction, repeated addition (a.k.a multiplication), and repeated subtraction (a.k.a division) can be achieved by creatively assembling these gates in a circuit, where one output can be connected to input of one or many gates.

Now that the most complicated part of this simple machine's design has been covered, we'll be exploring its memorization skills in the sequel.

Categories

Blog

The Global Talent Crisis Reshaping Cybersecurity: Lessons from Southeast Asia's SecOps Revolution

Beyond Alert Fatigue: How a Data-First Approach Is Reshaping Security Operations

When Machines Learn to Prime: Rethinking Autonomous Security Operations

Why the Barrier to 24/7 Security Operations No Longer Exists

Machine stories