Mapping Motives: Analysis of 2,000 Enterprise Cloud Detections One-Pager

Devo

Security Research Engineer - Architecture Innovation / Conference Speaker

Context

Presented Cloud Native SecurityCon North America 2023 research with Joshua Smith at Devo, analyzing 2,000 enterprise cloud detections to explain how cloud detections, controls, motives, ATT&CK mapping, and SIEM maturity patterns reveal the changing role of cloud infrastructure and workspaces in modern SOC programs.

Problem

Enterprise SOCs were rapidly expanding from traditional endpoint, network, and identity monitoring into cloud-native infrastructure, SaaS workspaces, multi-cloud environments, Kubernetes, and platform telemetry. Security teams needed a better way to understand which cloud detections mattered, how attacker motives appeared across detection content, and what mature cloud SIEM coverage looked like across real enterprise deployments.

What I did

• - Analyzed approximately 2,000 enterprise cloud detections to identify patterns in cloud-native security coverage, detection intent, and SOC maturity.
• - Mapped detection content against attacker motives, behavior patterns, cloud infrastructure risks, workspace risks, and ATT&CK-style analytic categories.
• - Used Devo cloud-native SIEM research context to understand how enterprise and MSSP deployments were incorporating cloud detections into modern detection stacks.
• - Compared cloud detections across infrastructure and workspace domains to understand where coverage was growing and where taxonomy remained fragmented.
• - Connected detection-engineering research to practical cloud SOC needs: onboarding, normalization, taxonomy, triage, and analytic prioritization.
• - Helped frame cloud detections as increasingly central to SOC strategy rather than an edge case beside endpoint or network monitoring.
• - Translated large-scale detection analysis into conference-ready security research for a cloud-native security audience.
• - Connected the work to broader Devo architecture innovation efforts around reference architectures, taxonomy standardization, Exchange-content validation, and migration patterns from legacy SIEM logic.
• - Used public conference and podcast moments to sharpen a practitioner-facing thesis: multi-cloud visibility, workspace telemetry, and provider-specific control fluency are becoming core SOC requirements.
• - Built research that bridges detection engineering, cloud-native architecture, threat modeling, and executive market education.

Outcome

• - Delivered conference-accepted research at CloudNativeSecurityCon North America 2023.
• - Helped position Devo's cloud-native SIEM research around enterprise cloud detections, attacker motives, and SOC maturity.
• - Created a public research story connecting 2,000 enterprise cloud detections to practical detection-engineering and cloud SOC concerns.
• - Strengthened the user's public profile as a cloud-native SIEM researcher and detection-engineering strategist.
• - Connected Devo architecture innovation work to public conference thought leadership.
• - Created reusable portfolio evidence for detection engineering, cloud security, SIEM modernization, cloud-native research, and conference communication.
• - Established a through-line from classic SIEM research to later AI-augmented detection engineering and agentic SOC workflow work.

Evidence

• - Public conference listings identify the talk as Mapping Motives Tells a Story: Analysis of 2,000 Enterprise Cloud Detections by David Wolf and Joshua Smith of Devo.
• - The Kubernetes Podcast from Google recorded David at Cloud Native SecurityCon 2023, where he identified himself as a cybersecurity researcher at Devo Cloud Native SIEM Platform.
• - In the podcast transcript, David described cloud detections and cloud controls in the SOC as increasingly important and stated that 1 in 4 SOCs had a majority of cloud detections in their SIEM detection stack.
• - The user's resume states that at Devo he analyzed 300 enterprise and MSSP SIEM deployments to identify maturity patterns and turn findings into research accepted at RSA and industry conferences.
• - The user's LinkedIn/Profile source states that at Devo he analyzed hundreds of customer deployments and turned findings into research accepted at RSA, Infosecurity Europe, and Cloud Native Security Conference.
• - Public-safe metric language; private Devo datasets, customer names, exact detection content, internal dashboards, proprietary taxonomy logic, and non-public research artifacts are omitted.