Beyond Co-Managed SIEM: Duck Creek's Blueprint for a Modern, Scalable SOC
How Duck Creek transformed Tier 1 triage with AI agents and freed its analysts for higher-value work.
The CISO
Trained to find the inefficiency
Benjamin Dulieu came to the CIO role by an unusual route, starting his career as a Marine. The traits that defined him then carry through to how he leads security now: agility, flexibility, and an instinct for spotting inefficiency and acting on it. The military gave him a career full of moments where he surprised himself with what he could do. AI is the latest.
Starting in his personal life, Benjamin began experimenting with how AI could increase his efficiency. He became fluent enough to see what was possible, and then applied that understanding to an enterprise operating model.
The Challenge
This is a fundamentally different type of architecture
He clearly saw how AI could change the way security operations ran at Duck Creek. Duck Creek’s software backs insurance companies, so they are processing enormous data volumes across disparate systems. They work solely in the cloud, so cost management sits at the center of every engineering decision. As Duck Creek's telemetry and cloud footprint expanded, the team saw an opportunity to redesign the operating model rather than continue scaling cost and manual effort linearly.
Not only were the monetary resources strained, but the SOC analysts were feeling the pressure as well. Something had to be done, and with AI coming on the scene, Benjamin knew that this was the train they had to board, or risk being left behind. Their team needed to move away from a centralized SOC to free the analysts from the benign alerts that they were processing daily.
The Approach
Agents as the connective tissue
Benjamin’s goal with integrating AI was to create a modern, scalable SOC that can evolve with the business and the threat landscape. He wanted to replace repetitive Tier 1 work with intelligent automation and AI insight for faster detection, clearer visibility, lower costs. Most importantly, he wanted to free his analysts for threat hunting, engineering, and strategy, the work that they came to security to do. Instead, agents would report to other agents as points of connection, pushing the low-value alerts (password resets, brute force) to agents and cutting logging costs.
One of the obstacles he faced as he pushed the organization to lean into AI was that he overestimated everyone else’s usage. He realized that this would not only be a technological shift but a cultural shift as well. The goal shifted to include educating his people on how to flex the AI and showing them how powerful this tool could be, giving others moments of clarity.
One of the most compelling outcomes has been 7AI's ability to support investigations. The platform can rapidly pull together evidence, correlate activity across large volumes of telemetry, and help analysts work through incidents faster and more comprehensively. Duck Creek has already seen strong results using 7AI this way, and it has become an important part of how the team approaches investigative work.
.jpeg)
Start with the basics, and they become believers
Start with the basics, show people, and they all become believers.
That belief shaped how he brought the rest of the company along. He invested in training, dozens of hours of it, and pushed his people to put the tools to work rather than admire them from a distance. He kept humans on the loop throughout, reserving them for the emotion, creativity, and strategy that agents cannot replicate, and framing every rollout around the why. When his own employees started arriving with their own ideas, he counted it as the real win.
"I don't feel like anything I said was utterly mind-blowing, but it just simplified it. Starting small."
For Benjamin, that is the whole game. The goal was never automation for automation's sake. It was to redesign how security work gets done, putting AI on repetitive work and people on the judgment, creativity, and decisions that matter most. The leaders who wield AI will define the next era of security, and the people who learn to wield it will define their own careers.
Your job won't be replaced by AI, but your job will be replaced by people who know how to use AI.
What comes next
RETHINK THE OLD MODEL. BUILD THE NEXT ONE.
The same technology reshaping Benjamin’s SOC is reshaping the other side of the fight. Adversaries are having their own moments of clarity, and the malicious uses of AI are arriving just as fast as the defensive ones. That raised the stakes on a change he already believed in.
The old security model was reactive, a team of incident responders waiting for something to break. Agents make a different approach possible: proactive, real-time, and capable of acting on what they see.
Getting there meant a harder decision than most transformations require. His instinct was to replace the old way outright and build something new in its place. This work is uncomfortable; it stresses people, and it asks a lot of a team. The return on that discomfort, measured in time and in dollars, is what makes it worth doing.
The conviction traces straight back to where he started his career. A Marine who learned to spot an inefficiency and act on it is now doing the same thing daily with AI, and pulling his team forward with him. The leadership job is not to do all the work, but to educate, inspire, and bring people along.
When asked what he would do with a magic wand and 25% of his time back, he would spend it making memories with his family and breaking the systems that need breaking.
.jpeg)
Making memories and breaking systems.
See for yourself
Hear the full conversation
Benjamin Dulieu joined 7AI's Nate Burke and Lior Div to talk through moving away from a centralized SOC, freeing analysts from around-the-clock toil, and the leadership mindset shift behind rethinking security operations.