The security industry has exactly one pitch right now. The single pane of glass. No context switches. Never leave the platform. It’s beautiful. The AI SOC.
They have been pitching this for 15 years. Could we be buying any more platforms in the meantime? The average SOC looks like a browser tab hoarding support group.
Meanwhile, while every vendor is busy drawing wireframes for the ultimate unified dashboard, the actual unified experience just shipped. And it shipped in a text box.
OpenCode, Claude, Codex: they’re sitting in a terminal, running subagents, hitting APIs, and coordinating actions across whatever systems you point them at. No fancy UI. No vendor lock-in. No waiting three quarters for a product team to approve your feature request. Just a prompt and a result.
The terminal is the new workbench. Because it turns out, the only interface that actually scales with agentic tools is plain text. The architecture underneath it is what matters: Model Context Protocol (MCP) servers exposing local data, subagents handling federated tool calls, and skills that get sharper every week. /commands are the new orchestrators. Your workflows compound. Your agents specialize. You don’t need a UI to click buttons if the machine can just do the thing you were going to click the button for.
Most security vendors haven’t noticed this yet. They are still selling buttons.
They’ll notice eventually. Probably right around the time they realize the analysts who figured this out are clearing twice the case volume using half the tools.
Those analysts aren’t writing LinkedIn posts about it, by the way. They’re just clocking off at 5pm.
To be fair, there is still a place for UIs in this new model. But it is mostly for the people who need visibility into the workflow, rather than the people doing the work. Dashboards for reporting. Heatmaps for managers to show their higher-ups that the team is doing its job.
The work itself? That happens in the terminal.
This isn’t an argument against good product design. It is an argument that the definition of “good product” just changed, and a blinking cursor beat a $100M roadmap to the finish line.