The United States Grand Prix was at the Circuit of the Americas in Austin recently. This year I was able to head out on race day for the F1 Experience, which included a pit walk and time learning about the cars, the crews, and how a race operation runs. I spent part of the day watching the BWT Alpine crew rehearse pit stops.
In the garage at COTA
Arctic Wolf is the official cybersecurity partner of the BWT Alpine team, so I started following the sport through that relationship. Once I dug in, it was the engineering side that drew me in. The more I learned about how a race team operates, the more it looked like the work I do every day building an AI-driven SOC.
Both are operations built around three things. They take in far more data than any one person can hold. They depend on a large group of narrow specialists who have to coordinate at high speed, with handoffs so smooth you barely see them. And they rehearse against simulated conditions until the real thing feels familiar. Below, I’ll walk through each of these for both the race team and the AI SOC.
Handling data beyond human scale
A Formula One car is covered in sensors. The telemetry streaming off it runs to thousands of channels, and that's before you add timing data, GPS, tire temperatures, weather feeds, and more. No single engineer on that team is looking at all of it. The volume makes that physically impossible, so the job of the organization is to divide the data up in a way that puts every slice in front of somebody qualified to interpret it.
In cyber, the challenge is the same. Security telemetry arrives continuously from endpoints, identity providers, cloud platforms, network devices, email providers and more. At Arctic Wolf we're taking in more than ten trillion events a week. Most security data is unremarkable, but you can’t tell which parts until they’ve been examined. At this scale, people alone can’t examine all of it.
Both sides are also working in conditions that keep shifting. For a race team, the track surface wears and evolves over a weekend, the weather moves, and tire behavior changes lap to lap, so what looked normal on Friday may not be normal on Sunday. In security, customer environments change constantly as new systems, users, and cloud services come online. In cyber there’s the added factor of an adversary who is deliberately trying to look like normal activity, which means we often don’t know what we’re looking for until it’s already in front of us.
Niche specialists are the only way through
An F1 team operates on deep specialization. Individual engineers own narrow domains: tire performance and degradation, aerodynamics, the power unit, reliability, with weather monitored closely throughout the weekend. The race engineer acts as the link to the driver, translating that collective analysis into clear, timely instructions, which makes communication as critical to the role as technical expertise. Many of these specialists aren’t at the track at all. They work from operations rooms back at the team’s factory, analyzing live data and feeding recommendations to the trackside team during each session. Each specialist owns a defined slice of the problem, and the organization is designed to bring those slices together into fast, coordinated decisions.
The depth of any one person matters less than the coordination between all of them. The team divides the problem so that each person owns the slice they're best at, and then somebody sits above all of it whose actual job is threading those parallel lanes back into one decision. A pit stop shows this coordination clearly. Around twenty people work around the car in a tight space, each with a single job, and the whole stop is over in a few seconds. That speed is only possible because every person knows exactly what their role is and where everyone else will be.
We build the AI SOC the same way. Instead of a single agent trying to be good at everything, we run a coordinated team of narrow agents, each very good at one slice of the problem, working alongside our human security experts.
Some of the agents are the ones you’d expect. There are agents that specialize in threat intelligence, agents that analyze a particular class of event log, and agents that assess the risk posture of an asset. Some agents act as the historian for a single customer’s security policy, so that at three in the morning we can ask whether a particular remote management tool is approved in that environment and get an immediate, informed answer. Others read back through a customer’s support history before an alert goes out, checking whether we’ve seen something similar before and whether the customer has already told us how they want it handled. A human analyst could do either of those things given enough time, but not for every case, at the speed required. Having agents take on that work means our analysts can start each investigation that they are involved in with the context already in front of them, and can spend their time on the tasks that need a person.
One difference from a race team is that we can scale specialists on demand. We can bring dozens of agents into a case in parallel the moment it needs them and release them when it doesn’t. What makes that useful is trust. An agent is only valuable if we’ve established what it’s good at, where its limits are, and when and if a task should move to a human. Defining those boundaries is as much a part of the design as the agents themselves.
Simulation as the starting point
Both operations depend on simulation to prepare for situations before they happen.
Formula One teams simulate obsessively. Oracle, whose cloud powers Red Bull’s race strategy simulations, says the team ran around six billion simulations for every race during the 2025 season, more than 200 billion across the year, and sustains roughly a million Monte Carlo simulations per second during the race itself. The goal is to have a prepared answer for every scenario that might arrive, so that during the race the decision has already been reasoned through and all that’s left is recognizing which situation you’re in.
The same instinct governs how we release AI into production, and I wrote about the mechanics of that in more detail in AI Quality Engineering Is Rising Faster Than the Labor Market Can Name It. Here's the short version. We build golden datasets out of real cases our experts have already resolved, and every change runs against benchmarks offline before any customer sees it. We look at what an agent concluded and how it reasoned. Once something is live, a separate model grades every response against a fixed rubric, and analyst corrections feed back into the datasets so the benchmark keeps growing.
Autonomy then gets earned in stages rather than granted at launch. An agent runs silent, then recommends, then acts, and it only moves up when the evaluation says it has earned the promotion.
A race team simulates the world so it can respond to it. We simulate for a similar reason: the range of situations our system has to handle is enormous, and it keeps changing. Every customer environment is different, new attack techniques appear constantly, and the tools and services our customers rely on evolve week to week. Testing against a broad and growing set of real cases is how we make sure our agents can handle that variety before they encounter it in production, and keep handling it as the landscape shifts.
And then it all collapses into a pit stop
All of that preparation, across both operations, exists to make one small window go well.
Those pit stop rehearsals can make or break the weekend outcome. Twenty or so people working the same two seconds over and over, with no result attached to any of it, until the sequence stops requiring anyone to think about it.
During the race on Sunday I watched the real pit stops live, and they looked the same as the rehearsals. Same positions, same sequence, just with a result attached.
That’s why we run simulations in the AI SOC. In cyber, the window that matters is the time between a threat appearing and a response taking effect, and it can be short. The work of simulating, testing, and earning autonomy in stages happens well before that moment, so that when a real threat arrives, our agents and analysts are carrying out a response they’ve already prepared for rather than working it out from scratch.
Where I'd send you next
I got to explore a lot of these parallels properly on a recent webinar alongside Nick Dyer Regional Vice President of Sales Engineering at Arctic Wolf and Rich Lockwood, Sporting Director for the Alpine Formula 1 Team. Hearing the racing side of it described by somebody who does the job was the best part of the conversation. If this comparison is interesting to you, that's where I'd point you. The Pit Wall Principle: How Human Judgment and AI Speed Run the Modern SOC
I'd love to hear whether this lands for anybody else working on agentic systems. Where are your narrow specialists, and what do you make them prove before you let them act on their own?
