SOC Analysts: You’ve Been Worshipping People Who Don’t Know You Exist

Let me ask you something.

How many ants have you stepped on in your life?

Hundreds? Thousands? Do you remember any of them? Did you lose sleep over a single one? Did you ever stop mid-stride and think, “I wonder what that ant was working toward”?

No, you didn’t. Because the ant was not part of your calculation. The ant was not even a variable. The ant was just something that happened to be in your path as you were heading to your destination.

Now imagine( and stay with me here) that the ant saw your foot coming and looked up in admiration. Studied the foot. Tried to understand how the foot thinks. Created foot conferences. Studied disasters created by feet. Practiced moving like a foot. Dreamed of one day being acknowledged by a foot.

And you, if you somehow knew this was happening, would probably feel terrible about it. Not because the ant was doing anything wrong. But because you would know something the ant doesn’t.

The ant will never be you or your foot. Ever! That is not a possibility that exists. And if you could say anything to that ant, if you could reach down and get its attention for one second, you would probably say: Stop. Please stop. Go do ant things. Build the colony. Find the food. Live the life that is actually available to you. Because watching something small waste itself, looking up at something that will never look back, is genuinely sad.

That is what is happening right now in cybersecurity.

And here is the part that should really bother you: it is the worship itself that keeps you small. Looking up is what locks you into the position where you have to look up. Every hour you spend studying attacker culture, hacking boxes without knowing what the hell is happening underneath, memorizing threat actor profiles, is an hour you did not spend becoming something the foot would actually have to notice and think twice about.

Shiny Hunters did not wake up this morning thinking about you. The groups listed in MITRE’s adversary catalog are not worrying about you. The people presenting at DEF CON this year are not considering you. The black hats that CISA is actively recruiting (while at hacker conferences, with their lanyards and government badges, trying to convince attackers to come work for the good side) are not factoring you into anything either.

You are not an adversary. You are not an obstacle. You are not even a concern.

You are the alert that didn’t trigger.

And while you’ve been practicing their techniques and their tactics and trying to earn some kind of proximity to what they represent, they have been doing their actual job. And what have you been doing? What headlines have you been making?

I’m not saying this to be cruel. Well, actually, I am. Because it’s sad to see, and you need a little tough love to snap out of it.

I’ve watched talented SOC analysts spend years chasing a culture that was never going to hand them a seat at the table. The attacker who just made international news for the Instructure ransomware attack — Shiny Hunters, look them up — is not studying your methodology.

They’re not studying you at all.

The hero worship only goes one direction. From you to them.

Here’s what’s actually happening while you’re looking up.

Organizations are going to DEF CON looking for hackers. Why? Because they want the person who can see things you can’t see. They want someone who can look at a system and imagine every way it was never meant to be used. Someone who can repurpose the function of something in their head before they ever touch it and ask “what can I make this do?” then actually make it happen.

That is where hacking actually begins. Not breaking things. Seeing things.

And the SOC analyst watching the alerts when things break is not part of that conversation.

The best SOC analyst in your organization right now is probably invisible to leadership. Not because they’re bad at their job. Because the job was designed to be invisible. Process the queue, write the report, and escalate when necessary. Repeat.

Nobody is building a conference around that or writing a threat intelligence profile on the analyst who caught the lateral movement at 3 a.m. Nobody is naming a defender group after the person who wrote the best incident report of 2025. We don’t even have defender groups!

And the answer to this, the thing that actually changes it, is not to think like a hacker. It’s to stop being impressed by them.

The moment you stop organizing your career around people who don’t know you exist, you get to ask a completely different question. Not “how do I think like them?” But “what do I actually know about this environment that nobody else does?”

That is a question worth answering.

That is the question that builds a career people notice.

Because here is what I know: the analyst who understands the systems, the mission, the dependencies, and the architecture is rare.

Genuinely rare.

And rare gets noticed even when you’re designed to be invisible. You don’t get there by going to DEF CON or getting high points in a CTF. You get there by knowing your environment better than the attacker who’s about to walk through it.

They’re counting on you not knowing.

That’s the only advantage they actually have.

Come find me at ypifany.org and on YouTube at personcenteredcyber.com where I get into this in ways a Medium article can’t hold.