School to SOC - 30 mistakes in 30 days

Cyber security graduates often enter the workforce with strong theoretical knowledge but quickly realise that understanding concepts is very different from triaging real alerts in a live Security Operations Centre. This Think Tank session explores that gap through a practical lens by breaking down 30 common mistakes that new SOC analysts make within their first 30 days.

While university education provides a solid foundation in networking, threat actors, and security frameworks, cyber defence in practice is far less structured. Alert triage involves incomplete data, constant noise, and decision making under pressure. Each alert requires a different approach depending on the source, context, and environment. There is no single playbook that applies to every situation, which is where many new analysts struggle.

Cyber defence is an extremely broad domain. Alerts can originate from identity systems, endpoints, network traffic, cloud environments, and more. Analysts are expected to connect these domains in real time, even though they are often taught separately. This creates a disconnect where graduates understand theory but find it difficult to apply during live investigations.

This session is built around real-world SOC experience and patterns observed in new analysts entering the role. I will introduce 30 common mistakes seen within the first 30 days and use them as discussion points to explore how analysts think, triage, and make decisions. These mistakes are not theoretical, they are drawn from real scenarios, including situations I have witnessed firsthand, as well as stories shared by other analysts across the industry.

The discussion will cover practical and often overlooked issues such as accidentally leaking sensitive data during investigations, leaving critical findings buried in private notes instead of documenting them for the wider team, and submitting real malware samples to public platforms without understanding the implications. It will also explore analytical mistakes such as over trusting alerts, focusing too narrowly on a single indicator, and escalating incidents without fully understanding what is being observed.

A key focus will be on behavioural challenges that are rarely taught but commonly experienced. This includes freezing when encountering a true positive, second guessing decisions due to lack of confidence, and not knowing what questions to ask. I will also introduce basic neurochemistry concepts such as fight, flight, or freeze responses to explain reactions under pressure, and how to manage them during investigations. Common mistakes such as jumping to conclusions, over investigating low risk alerts, or avoiding decisions altogether will be explored in this context.

As a think tank session, this will be interactive and discussion driven. Each mistake will act as a prompt for participants to share perspectives and approaches. I will introduce practical triaging processes and commonly asked questions and build on audience input to explore how different analysts approach the same alert.

The goal is to create an open and honest discussion about the realities of transitioning from university to SOC, while identifying practical ways to better prepare the next generation of defenders, aligning closely with AISA’s mission of strengthening the future cyber security workforce.