Bản chép lời đầy đủ của The Agentic SOC — Is the SIEM Dead? (2026 Reality Check)

WEBVTT 00:00:03.119 --> 00:00:06.379 In 2022, when attackers breached a network, it 00:00:06.379 --> 00:00:08.619 took them about 8 hours to hand it off to the 00:00:08.619 --> 00:00:13.359 next crew. In 2026, that handoff takes 22 seconds. 00:00:13.919 --> 00:00:17.120 22, your tier 1 analyst is still opening the 00:00:17.120 --> 00:00:19.920 ticket. That collapse, from hours to seconds, 00:00:20.140 --> 00:00:22.460 is the entire argument for the agentic sock. 00:00:23.000 --> 00:00:25.399 It's also why a lot of smart people are terrified 00:00:25.399 --> 00:00:28.559 of it. This is Tech Updates and today, is the 00:00:28.559 --> 00:00:31.160 seam dead? One number before we go further because 00:00:31.160 --> 00:00:34.759 you're going to hear it everywhere. 92%. Vendors 00:00:34.759 --> 00:00:39.140 say AI now handles 92 % of your alerts. Here's 00:00:39.140 --> 00:00:41.560 the problem. That's three different numbers wearing 00:00:41.560 --> 00:00:44.640 the same jersey. One vendor means AI verdict 00:00:44.640 --> 00:00:48.500 accuracy reached 92%. Another means it auto resolves 00:00:48.500 --> 00:00:52.719 92 % of alerts. A third means one customer saw 00:00:52.719 --> 00:00:56.840 a 92 % drop in response time. Same number, three 00:00:56.840 --> 00:01:00.090 unrelated claims. So when someone quotes 92 % 00:01:00.090 --> 00:01:04.090 the only correct response is, 92 % of what? So 00:01:04.090 --> 00:01:07.469 what's actually real? Quite a lot. Cisco and 00:01:07.469 --> 00:01:10.590 Splunk shipped six named AI agents inside their 00:01:10.590 --> 00:01:14.030 platform. Triage, guided response, detection 00:01:14.030 --> 00:01:16.989 building. CrowdStrike, Microsoft, Palo Alto, 00:01:17.129 --> 00:01:20.109 and Google all have agentic sock products now. 00:01:20.489 --> 00:01:24.299 And a wave of startups. Dropzone, profit, radiant, 00:01:24.579 --> 00:01:27.079 torque, are built entirely around autonomous 00:01:27.079 --> 00:01:29.939 tier one triage. The pitch is consistent. The 00:01:29.939 --> 00:01:32.459 machine reads the alert, investigates it, writes 00:01:32.459 --> 00:01:35.799 the summary, and closes the junk before a human 00:01:35.799 --> 00:01:39.200 ever sees it. The demos are genuinely impressive, 00:01:39.319 --> 00:01:41.819 but here's the reality check the vendors won't 00:01:41.819 --> 00:01:45.180 put on a slide. Only about 17 % of organizations 00:01:45.180 --> 00:01:48.560 have deployed AI agents at all, and nearly 90 00:01:48.560 --> 00:01:51.750 % of agent pilots never reach production. So 00:01:51.750 --> 00:01:54.730 most agentic sock is still a demo, not a night 00:01:54.730 --> 00:01:57.530 shift. And is the seam dead? The seam market 00:01:57.530 --> 00:02:00.530 just grew to 19 billion dollars. It's not dying. 00:02:00.909 --> 00:02:03.450 It's being disassembled and resold as parts. 00:02:04.069 --> 00:02:06.750 Cheap storage and a data lake underneath. And 00:02:06.750 --> 00:02:09.810 an AI investigation layer on top. Cisco bought 00:02:09.810 --> 00:02:13.389 Splunk for 28 billion. Palo Alto absorbed Q Radar. 00:02:13.689 --> 00:02:16.889 The seam didn't die. It got unbundled. Now the 00:02:16.889 --> 00:02:19.210 part that should keep you honest. Where these 00:02:19.210 --> 00:02:22.280 things break. Language models hallucinate and 00:02:22.280 --> 00:02:24.740 in a sock that means an agent can invent an indicator 00:02:24.740 --> 00:02:27.240 of compromise or fabricate a log entry wrapped 00:02:27.240 --> 00:02:30.780 in a confident, polished summary that reads exactly 00:02:30.780 --> 00:02:34.509 like good analysis. Worse... In a chain of agents, 00:02:34.710 --> 00:02:37.030 one hallucinating agent feeds corrupted data 00:02:37.030 --> 00:02:39.509 to the next, which trusts it. And here's the 00:02:39.509 --> 00:02:42.370 human failure. Studies find half of AI error 00:02:42.370 --> 00:02:45.750 reports get ignored, while 90 % of executives 00:02:45.750 --> 00:02:48.629 believe their tools catch those errors. We're 00:02:48.629 --> 00:02:50.789 automating the triage and the complacency at 00:02:50.789 --> 00:02:53.229 the same time. So what happens to the sock analyst, 00:02:53.389 --> 00:02:57.830 not replaced, reshaped? The tier 1 alert acknowledging 00:02:57.830 --> 00:03:01.289 seat is exactly the one the agent takes first. 00:03:01.789 --> 00:03:04.110 But the person who writes and audits the detections 00:03:04.110 --> 00:03:06.389 the agent runs, that's the detection engineer, 00:03:06.610 --> 00:03:09.030 and that job is getting more valuable, not less. 00:03:09.650 --> 00:03:12.830 The shift is detection as code, not detection 00:03:12.830 --> 00:03:15.509 as document. And a brand new role is appearing, 00:03:15.909 --> 00:03:18.810 AI oversight, the human who catches the agent's 00:03:18.810 --> 00:03:22.580 mistakes and turns them into fixes. 64 % of 2026 00:03:22.580 --> 00:03:25.979 security job listings now require AI or automation 00:03:25.979 --> 00:03:29.060 skills. The alert monkey seat is closing. The 00:03:29.060 --> 00:03:31.800 seat above it is wide open. So what do you actually 00:03:31.800 --> 00:03:34.960 do and what does the exam want? Four things. 00:03:35.400 --> 00:03:38.960 One, automate tier one triage. Not the decisions. 00:03:39.439 --> 00:03:42.379 Let agents close the noise. Keep humans on the 00:03:42.379 --> 00:03:45.439 calls that matter. Two, demand an agent baseline. 00:03:45.800 --> 00:03:48.300 You can't detect a rogue agent if you never defined 00:03:48.300 --> 00:03:51.180 what normal looks like and almost nobody has. 00:03:51.539 --> 00:03:54.939 3. Learn detection as code. Python, playbooks, 00:03:55.219 --> 00:03:57.560 detection engineering are the durable skills. 00:03:58.000 --> 00:04:00.860 And 4. For the exam, PSI -SA Plus and Security 00:04:00.860 --> 00:04:03.879 Plus already test SOAR and crucially when not 00:04:03.879 --> 00:04:06.900 to automate. That objective is the skeptic case 00:04:06.900 --> 00:04:11.500 written into the test. Here's the close. Attackers 00:04:11.500 --> 00:04:14.060 now move in seconds, and humans simply cannot 00:04:14.060 --> 00:04:17.019 triage at machine speed anymore. So yes, agents 00:04:17.019 --> 00:04:18.899 are going to run the front line. The seam isn't 00:04:18.899 --> 00:04:22.319 dead. The tier 1 seat is. Just make sure someone 00:04:22.319 --> 00:04:24.920 is actually watching the agents. Because right 00:04:24.920 --> 00:04:27.420 now, we've pointed AI at the alert queue and 00:04:27.420 --> 00:04:29.800 mostly walked away. And that's the next breach 00:04:29.800 --> 00:04:32.500 waiting to happen. That's the show. Send it to 00:04:32.500 --> 00:04:34.899 whoever just bought an AI sock platform on a 00:04:34.899 --> 00:04:37.300 keynote promise. We're back next week with more 00:04:37.300 --> 00:04:38.819 tech updates. Stay sharp.