TRANSCRIPTION 🔗
WEBVTT
00:00:03.119 --> 00:00:06.379
In 2022, when attackers breached a network, it
00:00:06.379 --> 00:00:08.619
took them about 8 hours to hand it off to the
00:00:08.619 --> 00:00:13.359
next crew. In 2026, that handoff takes 22 seconds.
00:00:13.919 --> 00:00:17.120
22, your tier 1 analyst is still opening the
00:00:17.120 --> 00:00:19.920
ticket. That collapse, from hours to seconds,
00:00:20.140 --> 00:00:22.460
is the entire argument for the agentic sock.
00:00:23.000 --> 00:00:25.399
It's also why a lot of smart people are terrified
00:00:25.399 --> 00:00:28.559
of it. This is Tech Updates and today, is the
00:00:28.559 --> 00:00:31.160
seam dead? One number before we go further because
00:00:31.160 --> 00:00:34.759
you're going to hear it everywhere. 92%. Vendors
00:00:34.759 --> 00:00:39.140
say AI now handles 92 % of your alerts. Here's
00:00:39.140 --> 00:00:41.560
the problem. That's three different numbers wearing
00:00:41.560 --> 00:00:44.640
the same jersey. One vendor means AI verdict
00:00:44.640 --> 00:00:48.500
accuracy reached 92%. Another means it auto resolves
00:00:48.500 --> 00:00:52.719
92 % of alerts. A third means one customer saw
00:00:52.719 --> 00:00:56.840
a 92 % drop in response time. Same number, three
00:00:56.840 --> 00:01:00.090
unrelated claims. So when someone quotes 92 %
00:01:00.090 --> 00:01:04.090
the only correct response is, 92 % of what? So
00:01:04.090 --> 00:01:07.469
what's actually real? Quite a lot. Cisco and
00:01:07.469 --> 00:01:10.590
Splunk shipped six named AI agents inside their
00:01:10.590 --> 00:01:14.030
platform. Triage, guided response, detection
00:01:14.030 --> 00:01:16.989
building. CrowdStrike, Microsoft, Palo Alto,
00:01:17.129 --> 00:01:20.109
and Google all have agentic sock products now.
00:01:20.489 --> 00:01:24.299
And a wave of startups. Dropzone, profit, radiant,
00:01:24.579 --> 00:01:27.079
torque, are built entirely around autonomous
00:01:27.079 --> 00:01:29.939
tier one triage. The pitch is consistent. The
00:01:29.939 --> 00:01:32.459
machine reads the alert, investigates it, writes
00:01:32.459 --> 00:01:35.799
the summary, and closes the junk before a human
00:01:35.799 --> 00:01:39.200
ever sees it. The demos are genuinely impressive,
00:01:39.319 --> 00:01:41.819
but here's the reality check the vendors won't
00:01:41.819 --> 00:01:45.180
put on a slide. Only about 17 % of organizations
00:01:45.180 --> 00:01:48.560
have deployed AI agents at all, and nearly 90
00:01:48.560 --> 00:01:51.750
% of agent pilots never reach production. So
00:01:51.750 --> 00:01:54.730
most agentic sock is still a demo, not a night
00:01:54.730 --> 00:01:57.530
shift. And is the seam dead? The seam market
00:01:57.530 --> 00:02:00.530
just grew to 19 billion dollars. It's not dying.
00:02:00.909 --> 00:02:03.450
It's being disassembled and resold as parts.
00:02:04.069 --> 00:02:06.750
Cheap storage and a data lake underneath. And
00:02:06.750 --> 00:02:09.810
an AI investigation layer on top. Cisco bought
00:02:09.810 --> 00:02:13.389
Splunk for 28 billion. Palo Alto absorbed Q Radar.
00:02:13.689 --> 00:02:16.889
The seam didn't die. It got unbundled. Now the
00:02:16.889 --> 00:02:19.210
part that should keep you honest. Where these
00:02:19.210 --> 00:02:22.280
things break. Language models hallucinate and
00:02:22.280 --> 00:02:24.740
in a sock that means an agent can invent an indicator
00:02:24.740 --> 00:02:27.240
of compromise or fabricate a log entry wrapped
00:02:27.240 --> 00:02:30.780
in a confident, polished summary that reads exactly
00:02:30.780 --> 00:02:34.509
like good analysis. Worse... In a chain of agents,
00:02:34.710 --> 00:02:37.030
one hallucinating agent feeds corrupted data
00:02:37.030 --> 00:02:39.509
to the next, which trusts it. And here's the
00:02:39.509 --> 00:02:42.370
human failure. Studies find half of AI error
00:02:42.370 --> 00:02:45.750
reports get ignored, while 90 % of executives
00:02:45.750 --> 00:02:48.629
believe their tools catch those errors. We're
00:02:48.629 --> 00:02:50.789
automating the triage and the complacency at
00:02:50.789 --> 00:02:53.229
the same time. So what happens to the sock analyst,
00:02:53.389 --> 00:02:57.830
not replaced, reshaped? The tier 1 alert acknowledging
00:02:57.830 --> 00:03:01.289
seat is exactly the one the agent takes first.
00:03:01.789 --> 00:03:04.110
But the person who writes and audits the detections
00:03:04.110 --> 00:03:06.389
the agent runs, that's the detection engineer,
00:03:06.610 --> 00:03:09.030
and that job is getting more valuable, not less.
00:03:09.650 --> 00:03:12.830
The shift is detection as code, not detection
00:03:12.830 --> 00:03:15.509
as document. And a brand new role is appearing,
00:03:15.909 --> 00:03:18.810
AI oversight, the human who catches the agent's
00:03:18.810 --> 00:03:22.580
mistakes and turns them into fixes. 64 % of 2026
00:03:22.580 --> 00:03:25.979
security job listings now require AI or automation
00:03:25.979 --> 00:03:29.060
skills. The alert monkey seat is closing. The
00:03:29.060 --> 00:03:31.800
seat above it is wide open. So what do you actually
00:03:31.800 --> 00:03:34.960
do and what does the exam want? Four things.
00:03:35.400 --> 00:03:38.960
One, automate tier one triage. Not the decisions.
00:03:39.439 --> 00:03:42.379
Let agents close the noise. Keep humans on the
00:03:42.379 --> 00:03:45.439
calls that matter. Two, demand an agent baseline.
00:03:45.800 --> 00:03:48.300
You can't detect a rogue agent if you never defined
00:03:48.300 --> 00:03:51.180
what normal looks like and almost nobody has.
00:03:51.539 --> 00:03:54.939
3. Learn detection as code. Python, playbooks,
00:03:55.219 --> 00:03:57.560
detection engineering are the durable skills.
00:03:58.000 --> 00:04:00.860
And 4. For the exam, PSI -SA Plus and Security
00:04:00.860 --> 00:04:03.879
Plus already test SOAR and crucially when not
00:04:03.879 --> 00:04:06.900
to automate. That objective is the skeptic case
00:04:06.900 --> 00:04:11.500
written into the test. Here's the close. Attackers
00:04:11.500 --> 00:04:14.060
now move in seconds, and humans simply cannot
00:04:14.060 --> 00:04:17.019
triage at machine speed anymore. So yes, agents
00:04:17.019 --> 00:04:18.899
are going to run the front line. The seam isn't
00:04:18.899 --> 00:04:22.319
dead. The tier 1 seat is. Just make sure someone
00:04:22.319 --> 00:04:24.920
is actually watching the agents. Because right
00:04:24.920 --> 00:04:27.420
now, we've pointed AI at the alert queue and
00:04:27.420 --> 00:04:29.800
mostly walked away. And that's the next breach
00:04:29.800 --> 00:04:32.500
waiting to happen. That's the show. Send it to
00:04:32.500 --> 00:04:34.899
whoever just bought an AI sock platform on a
00:04:34.899 --> 00:04:37.300
keynote promise. We're back next week with more
00:04:37.300 --> 00:04:38.819
tech updates. Stay sharp.