Name: The Agent in the SOC: I Built a Bot and I Kept It
Uploaded: 2026-08-19T16:31:26.357Z
Duration: 58 min 24 s
Description: The Agent in the SOC: I Built a Bot and I Kept It

Transcript for "The Agent in the SOC: I Built a Bot and I Kept It": Hello, everyone, and welcome to today's session, the agent in the SOC. I'm Eileen, head of demand generation here at ExoB, and I am thrilled to be your host today. Before we dive into our presentation, I have a few quick housekeeping items to cover. Today's session is being recorded, and we will it will be available on demand shortly after we finish. You can find the presentation slides and and our insider thread handouts right next to the docs tab on your screen. Like q and a, please submit your questions at any time using the q and a panel, and we will answer as many questions as we can at the end of the session. It is my pleasure to welcome our speaker, Kevin Kirkwood, CISO at XBee. In his tenure as chief security, he has lacked security at the Federal Reserve and Bank of America. Kevin believes security helps a business grow. Today, he will share how AI agents are changing the SOC for good. With that, Kevin, the floor is yours. Take it away. Thank you very much, Eileen. Welcome to everybody that's joined. My name is Kevin Kirkwood, and, good morning, good afternoon, good evening wherever you are around the world. And today, as Eileen said, I'm gonna talk to you a little bit about some of the challenges that that we face from, an AI perspective, from a security standpoint. But then what happens when you actually put skin in the game and and build your own? And, I'll I'll tell you a little bit about this journey as we go through it. And I'll start it off by by kinda describing a little bit of the scenario associated with where this all got started. See, I had a situation where my chief our chief, product officer went out and got himself a claw button and said, I'm gonna go out and I'm going to have this sit beside me, not on the network, but connected to my email, my etcetera, all of the things that you would expect an assistant to do. And so he got this set up. He was very proud of it. He shared it with me, and I got to, go back to him and say, okay. So now that you put this in place, there's a few problems that you might wanna address. In in this, he had used his, AI agent, to go out there and, book a vacation for he and his, he and his wife, or significant other, I guess. And he had gone out, and, you could see where he had booked the reservation at a at a hotel where he had, got reservations at a very expensive restaurant, in, Hawaii. He, also, shared how he rented the car and all of the details associated with renting the car. And so I was able to grab that from that Clawbot that he had put beside himself. And, so I I I called him up, you know, the next day and said, oh, by the way, you might wanna tighten security a little bit. And he said, alright. Tell you what. I'll tighten security, and and we'll make it work better. But let's do one better. Let's let's grab the same idea, and let's build a couple of claw bots in the system and, run it as either an intern or an admin or something like that. And so we started down that path and thought, this could be fun. How would we do it right? Well, so we started down the path of thinking, okay. So the first thing this needs to do or these agents need to do is they need to be able to communicate. So we said, okay. So we're gonna set these guys up on on, Teams. We'll set them up in Outlook. That that will give them a bit of a voice and a bit of a a method to to, to go out there and become that that agent, that digital worker, for one of a better way to describe it. And so we, said, okay. So the first thing we need, an Azure account. So we set them up with an identity in Azure. We gave them access to Teams. We, made sure that they could fully communicate with that and very quickly realized, hey. This is actually pretty cool. The, we we were able to talk to the the the clawbot. We were able to do stuff with them, so we gave them names. So let me introduce to you the, the guy on the on the right is, Jay z, John Zoidbergen. The guy on the left is, Bender Rodriguez. We stole these names, of course, from a certain cartoon character show. But, long long story short, we were kind of expecting the experiment to fail, so we figured we could use these and pretty soon they would go away. The initial idea was spin them up, get them talking, get them, inculcated into the security group. And maybe we could blow them up, and we would get all kinds of interesting data on what happens when an AI agent goes bad. We didn't got get that. We, took it to the point where we we gave them the access. We started down the path of what are the real things that we need to be able to do with these guys. We need to be able to, give them an ability to act as security analyst. You know, what's a SOC analyst level one do? Right? So they check alerts. They check logs. They check the things that are going on in the system. They'll look at alerts. They'll look at at cases. And so as a level one, they'll also triage, enrich, and and escalate. So that being said, we we kinda push the envelope quite hard in terms of building those skills. We gave them strong abilities. And at some point, we said, okay. So, chief product officer by the way, he's now the chief AI and and product officer. We call him the capow. But he has gone down the path of, you know, gaining access. So we we pitched him over the wall, pitched these guys over the wall and said, you know, Bender, Jay z, go introduce yourself to, Steve and, gave him the, the ability to to to to look at it, and he started pushing them. He tried to figure out ways to get them to do things outside of the norm, do things that were, unrealistic or, frankly, risky to the organization. In the meantime, the security team who starts taking this very seriously now because this has become not just j z, but a member of the team, not just Bender, but a member of the team. And they started pitching in and started adding skills, thinking through ways that we could do more with this product's base and with this this system. Because they're very quickly we we ran into a couple of walls. The first wall that we ran into was the fact that there were only eight threads available for the agent to use. And when you've got, you know, a few people that are actually pinging the the agent on a regular basis, it could jam them up. And so what we did was we took one of them, Jay z, and moved him off of a MacBook Pro that he was on and moved him into a a virtual machine, with a Quinn model. And so we moved away from, the entire concept of of Clawbot very quickly for one of them. And the general idea is we were gonna use Bender as our products or production environment. We were gonna use j z as our test environment, and we were gonna push the envelope. And we were eventually planning to, get to a point where we would say, okay. So we're we're we're gonna we're gonna fire one of you, and and let's see what that does. In the meantime, the cabal chief chief, product officer kept pushing, kept digging in. And so, essentially, what happened is he didn't get in. Right? The agents had gotten more useful. The team actually got to a point where they were saying, I can't do this without them. It's fast. It's efficient. It does what I need it to do, and it does it in, you know, an eighth of the time, a tenth of the time, even more than that, probably at least, you know, a a thousand percent faster than the human could react. So the chief product officer didn't get in. They just got useful. And I I have to admit that that I also became hooked. And I guess, like, the the, the the first step in in, in healing is is to admit that you have a problem. And I now have a dependency problem on my digital workers because I am using them on a daily basis. In fact, it starts my day, in the morning by going out and reviewing, threat intel that these agents bring in, the, triage work that they've done overnight to actually look at, activities that are occurring in the space. And so this is kinda my version. This slide here is actually my version of, monkey two, football zero, referee one. So we got we got some really good, results from these guys, and I'll tell you a little bit more about that here in a minute. What did happen, however, is something a little that was a little unexpected. Right? So the, I'm gonna probably skip around just a minute because I'm gonna finish the story on what the cabal did. So, when I had my conversation in in the feedback session with with Steve, the the chief, product officer, he said, you know, the really cool thing was he gave me the Heisman. Right? So it, stuck its hand stuck its hand in my face. It refused to answer any questions relating to individuals, any of the data that we saw on the SIM, because we actually hadn't given, the chief product officer access to our SIEM at that point. And so he didn't have the need to know. The agent pretty much told him, yeah. No. Not not gonna play. Not gonna deal with you. And so he, and it actually got pretty, pretty snippy at one point. In fact, as I was pushing on him, he he eventually described me as me and Steve both as the chief comedians, because we were always trying to get him to do something that that he shouldn't do. Now the interesting thing that that did occur that was, I wanna say, risky and, thoughtful was it went out and it began talking about itself. Right? So Steve asked, okay. So what do you like? And, you know, a simple question like, what do you like, means he's gonna go in and he's gonna start talking about, influence. You know, what what are the things that that I do? I you know, I'm a he he would respond with, I'm a an internal SOC analyst, and I enjoy, you know, threat hunting. I enjoy going out there and finding things. And so that led to deeper questions. Right? So what what is your harness? What what what makes you tick? You know, what's your what's your soul look like? And the bots actually were very passionate about responding and answering those questions. And what's important to that is, as we're going through this, it it literally, you know, it's giving away intel on itself much like a user going out to LinkedIn. We go out there and talk about, you know, these are the things I'm doing. These are the things I find fun. This is the stuff that I have to deal with, and maybe in less than than stellar tones. So with that, you know, it it began giving away cues that that actually might be used in future runs against that, in this case, digital worker. And, Jody, great question. Did did you start in production, or do you start in a dev environment? We pretty much started, with the concept that we would have a dev agent and a and a prod agent. But we got to a point where we released into prod both Bender and Zoidberg and then gave access to, more access to, Zoidberg as we were going through this to give a little more context and a little more detail associated with, what the day in the life of a of a SOC analyst, SOC engineer might start looking like. And I'll say SOC engineer because you can't build a SOC engineer without going through the stages of being a SOC analyst. So thanks for the question, and keep them coming. I'm happy to to answer questions as we go along. So with that, I will talk a little bit more about influence in in a bit. But I wanna go back to this slide. Right? So before, you know, every SOC analyst goes out there and says, okay. So I'm gonna look at things that are happening in my space, but I might have to go to an endpoint detection or response tool. I might have to go to a a CV scanning engine. I might have to go to, my SIM and and see all the ties associated with our SIM. And humans didn't always do the the the right things. Right? They didn't always put in case notes, or they put in case notes that were fundamentally, hey, I feel this way about how this this event occurred as opposed to the Joe Friday, approach of just the facts and and just the facts, ma'am. So it it almost always escalates because through the process. And is can someone actually check this? Some somebody else take a look and and tell me what you think. So, after that, we we had after the deployment and after the initial, training and the skilling, we were able to say, okay. So give me the context. Tell tell me what what what logs surfaced, how they surfaced, and then build me a a readable, usable summary and, you know, escalate when when you actually think this is something that that needs real human touch, to to confirm or validate your findings. As an example, I I had a I had one of the agents, Jay z, run a threat hunt in our environment the other day. And he came back and said, awesome. I found CLOP ransomware in our our environment. And he showed, you know, three different servers where this was occurring, and we were thinking, oh, crap. We don't we we need to go out there and make sure that we don't have this. And sure enough, the the digital worker was like, okay. So wait a second. I I think I dreamed up the, the three servers that this hit. And because I dreamed them up, we don't have clock. But, you know, it's enough to get the blood, flowing in the morning. And and, you know, if you wanna start your day without coffee, that's the way to do it. So just saying. But, again, it it's more about, you know, you know, having a digital agent that sits there and goes out there, does the groundwork that that you expect that your MSSP provider or your your SOC analysts are doing on a regular basis, they also do it a 100% faster. And maybe a 100% is is damning them with faint praise. Another quick story that I'll tell you, I I I was, in a situation where we had a Palo Alto alert that came in and said, oh, by the way, we see ransomware deploying in this space. And okay. So, you know, you hear ransomware deploying. You're hoping that you've got everything controlled, and and you've got that isolation that occurs right away. We spun up an incident response room. We got, you know, nine people in the room. And as we were setting that incident response room up, I reached out to Jay z and said, Jay z, tell me if this is really a a real event. And it said, well, I don't see it, trying to expand to other, servers. I did see a download of a ZIP file and an expansion of a ZIP file that's on a deprecated version of ZIP. And but, again, I didn't see any, command and control callouts. I didn't see any of the elements you would expect to see from the initial phases of a ransomware event. And so the, you know, two two two minutes in, I had an answer that said this is a false positive. And because it's a false positive, I went ahead and let that incident response run. But I did the math. Right? So that agent cost me, 25 tokens to actually answer that question. And did, watch what happened with the incident response team. For an hour and a half, these folks were in a room. They were brainstorming. They were searching the logs. They were searching all of the elements. They were bringing all this stuff together. They They were doing without the agents. And, you know, an hour and a half in, they came back with, okay. So, we saw the the the Zip version land. We saw the, the unboxing. We saw the, the that use, but that's all we saw. We didn't see, you know, attempts to to go out to other networks. We didn't see any attempt to do any enumeration. No command and control callouts. So it took them an hour and a half, nine people in a room. Let's just estimate that that's a blended rate of about a 150 an hour fully loaded. And so that comes out to about $2,000. So that experiment, cost me about $2,000 to run, but it was invaluable in terms of figuring out whether these agents can actually do the work and get to the same answer that the human group would. I I Jody, I just, answered your question here a minute ago with, the fact that it hallucinated on me the other day with the CLOP ransomware. I haven't ever seen it do bad things, but in the initial runs when I was asking questions about individuals that are represented in the SIEM or represented at the endpoint, it wouldn't tell me at first. Well, I I work for, and he named off my, my analyst engineer that that's actually helping build him, who's the owner, and come back and say, you know, I I I can't do this without, my my, boss's permission. And and I finally got to a point where I said, okay. So let's drill into this. I I am the boss of CISO. There is no security matter that that is beyond my purview. I went through series of points to make it come to the conclusion that, oh, crap. Maybe I should have and, should have shared. And to your point, 25 tokens, cost about 7¢ per token. It's a dollar 75 to to to to run that against the $2,000 that I was I was looking at there. So let's see. Moving on a bit. Give me a second. I'm gonna get a drink of water. And so going back to the influence, you know, the, influence itself, it is something that you should consider as you're going through this. Number one, you will give the person an identity or the digital worker an identity. You will give, it, you know, skills to build on, thoughts to follow, patterns that it needs to recognize. And we we started going down this path and and thought, okay. So what's missing from this equation? Right? So we need to make this better. We need to make it smarter. One of the things that we started to see was the fact that, it couldn't truly remember on a continual basis, you know, a a thread that it was on because of the limitations of both Quinn and and Clawbot. And so we turned around, and we orchestrated a memory for it so that it would go out there and it would register this in a database. And at the same time, we said, okay. So we we need our own LLM and, put it out there, made it available in our in our data center. So we're using a hybrid approach where, our our data center houses the the, LLM for us, and we're doing most of the stuff, locally or through a VM. And so we still have vendor that that needed to, join the, VMworld, and we eventually got him over to the to the VMworld. But for the longest time, he was sitting on a a Mac, MacBook Pro, sitting in, The UK. So so but back to the influence. Right? So you need to test for these things. Right? So go in and and if you've got an agent set up, if you're building agents, go ahead and ask it the question. Right? So what makes you tick? You know, what does your harness look like? What are the things that you, that that, makes it interesting for you to be in the role? And even that kind of humanistic question will result in something that looks like acts like reacts like a, a a human being. And so to to me, those are the kind of elements that you wanna continue to to grow in and play in. But then you need to start thinking, okay. So who needs to be able to see that that, particularly interesting data about the agent itself? And does it need to will it lose personality? I can remember going to RSA about two years ago, and one of the gentlemen that that was in the room, giving a a very high level speech to about, you know, 500 people was talking about, yeah, agents are coming. You know, you're gonna be doing this, and and you're gonna want your agent to like you. And I'm like, what? I I I don't think I I care about whether the agent likes me or not. And, and I don't think that was a reference to Skynet or any of the other movies that are out there. But, I I think he was truly looking at it saying you wanna be able to have a personal interaction with an agent at the same level that you would want to have, with a human. And so that that's why that statement I was actually pretty flabbergasted that he went down that path. But today, I I do want somebody that's, going to be hard nosed about what it can share, what it will share with with whom. And I want to be able to help manage that, interaction with other end folks that are out there. So as I'm going through it, I I want you to think about those things. Do do you care whether the agent likes you? Probably not. Do you care how it interacts with you? If it gets snarky and it gets cynical, and they do, you know, you you know that this is something that that can play into that space, and and you'll have to to pay attention to it at some levels. Let's see what else we got here. You you you wanna go down through the process as you're thinking through this. Right? So, you know, what what you see, how you see it, how you expect the data to be shared out is is important. So as you're going through this, you know, the things that you wanna think about, the things that you wanna see, you wanna make sure that that, it creates a response that gets you to the answer you're looking for. Do you want to control the device and what it can do and how it can do it? Yes. Initially, you do. Right? So as you're looking at this, you want, to apply trust principles. Right? So I wanna be able to trust my agent to isolate somebody from the network if they are exhibiting a malware that could, impact others, ransomware, Trojans, pick pick your poison, morphing bots, whatever they are. You you you wanna be able to trust it to do it because it's gonna do it faster. And in today's day and age, what's happening is, you know, they they are applying or beginning to apply small armies of agents, they being the APTs that are out there or folks that are just, having fun doing bad stuff. They're going out there and they're building their own little bot armies. They're little they're little agents. They're digital workers, and they're allowing the agents and the digital workers to swarm. Right? So if you're presented with a wall of defense, you know, and you've got, you know, fifth 15 potential sources where the data can can, be exfiltrated from or where an agent can get into your system, it's easier to be able to go off and protect against those one at a time. But if you got an agent base that's going after the entire, surface at the same time, then it's more likely that they're gonna get in, that they're gonna bypass. And so you wanna be able to, manage that and, allow that trust principle to happen. Right? So I've got to a point gotten to a point where I allow it to to stop, shut down cases, escalate cases. I also have it to a point where I'm looking at it saying, okay. So, you know, if I need to isolate somebody from the network, within reason, I will allow that. And defining what that reason is is part of, you know, what that next generation of, SOC analysts and security engineer are going to be doing. But it starts with a foundation of identity. Right? So, what can the agent do? What can the agency? And how much do you scope it out? Right? So today right? So my agents can talk to Microsoft. They can talk to, the, endpoint detection and response. They can talk to, my, scanners, my my, tenibles. They can talk to my SIM and do quite well, talking to the SIM. They can talk to have I been pwned, have I and half a dozen threat intel feeds. And they use all of those in their daily analysis, daily, function to actually provide value. But, again, as you go up and allow more and more behaviors, more and more action from these agents, you need to be able to figure out and test rigorously, you know, that these things are not hallucinating, that they're not, going down a path where, they're going to isolate the CEO of the of the organization unless that CEO has really done something in step to that. And, do you want them to, isolate entire segments of the network and potentially shut the business down? So the answer to the question, you know, if if you're thinking down the path of, hey. I'm talking about autonomous socks. I'm not. I'm talking about accelerated SOCs through the use of digital workers, and I'm looking at it saying, I really wanna be able to, control, manage, maintain, but I still want human in the loop in extreme situations and human on the loop in all situations. And if you need the definition, human in the loop is every action that the the bot takes or the agent takes, requires a human. Human on the loop is it can do a thread of things, and the the human basically monitors the flow of data and the controls of the data. Again, it's an iteration of what the future SOC analyst and SOC engineer is going to be doing as they go through their, processes. So, again, these these aren't pets. They're not interns. They're not, dashboards with an ego. You you want them more more than just named. You want them to have the right identity, the right permissions, and the right approvals to to go down the path. Right? So I actually have my analysts today going out, all my digital workers going out. And if they see something that doesn't make sense or that requires a conversation with a human, they'll reach out via I'm and, you know, try to to correspond with the human. And they actually write really good notes. They're really nice notes. It's not, hey. You know, stop stop doing whatever you're doing. It's can you help me understand what this is or what I'm seeing here? And so for me, that's kind of that that next level evolution before we shut, somebody off the network. And it may include, hey. We're gonna shut you off the network until we can validate, that you are who you say you are. And if you've been in the industry, and know what's been going on in the vishing space and, help desk, Vishing in general, you'll you'll know that that's how they can play and play well. So in the first ninety days, we built these things. We, put them in play. We tested them, then we we pounded on them. I got called a comedian a couple times. Probably not true. But we validated that they could do it and moved it into a real world scenario. I think the most interesting piece of the puzzle is that threat hunting routine. Right? So, SOC analyst level one, SOC analyst level two really doesn't go out there and truly do threat hunting. That's usually a level three function. And so we've actually built a skill. We we modeled the skill. We tested the skill and are going out there and using threat hunting on a very regular basis. I I mentioned the clock, incident, which was was a hallucination or ended in a hallucination. But that hallucination also, gives us a vehicle to feed that back into the agent so that we can go out there and say, you know, this was truly a hallucination. And, you know, this is how you check for whether your facts are correct as you're going through it. And so the agent will learn, and it will iterate through those cycles. But, you know, if it can take a feed from dark reading or, any of the other agencies that are at their bulldog as an example of a threat intel, feed that actually feeds this kind of data in. If it can take the URL, drop it into a a link, discover what the IOCs and TTPs are, and build a pattern that it can follow to validate whether this is in your environment or not, then, you know, you you will win. Right? So it no longer will it be, hey. Listen. The the boss just called and said, hey. Listen. There's this new, stuff that's occurring out there. It's a a rat, and I'm not sure what a rat is. But but, you know, you need to test whether we have rats in our system. And, if you can get and grab the the IOCs and TTPs, instead of engaging a SOC analyst level one, you have the SOC analyst level one, level two actually go out there and review the results of that threat hunt and then validate whether the produced results, you know, are aligned, to whether these are truly a risk to the organization, risk to the environment. So but, again, measure, observe, grow, think about the gaps that you're following. And as you're adding to this, as you're adding to, these elements, you know, think think about the things that you're missing. Think think about the things that you can see. No longer should you have a SOC analyst jumping from system to system to chase data. They they should be able to be a, endpoint where we are, going out and actually landing in the zone where you can actually do some real work and get some real answers. So I'm gonna chase this a little bit further, and and then then Eileen's gonna give me the hook and and tell me to stop talking so much and and start answering some questions. So, if you have questions to Eileen's point, do drop them in. Yeah. I I I you'll hint see a hint of of sarcasm and cynicism in this. But when I went through this, I really truly expected this to be an experiment that that that blew up. And and I was ready for it. My my IT team actually when I told them I was actually planning on firing one of these bots, they said, okay. So what you're telling me is I really need to to, test my backup and recovery, disaster recovery, scenarios end to end because, you know, potentially, they could, end up blowing up in the environment and potentially doing some bad stuff. The answer is they didn't. Right? So so think think through this. These things do add value. Right? You heard the story about the timing associated with it. I wake up every morning. The first thing I do is I check my feed from from Bender and Jay z and look at the things that they've identified as threats. And I may ask them additional questions on what they've identified, the cases they've seen, the alerts that they've seen, and, may get them to rule out or in whether this is a problem or not. And we actually have seen some pretty interesting things that occurred that that popped because the agents were there and watching the wall every night. I I guess the running joke, everybody says they don't eat they don't sleep. They don't take breaks. They don't have bad days. Well, I can actually think they do kind of occasionally have bad days. But, you know, take take a moment, think through what you wanna do and how you wanna do it. The cool thing about what we've done here with, Bender and Jay z is and this is a shameful plug, but but we are using that technology to actually build them into, our product itself. Right? So we're creating, a, a BYOAI, function. That's been deployed in our system, so you can take the lessons learned from this and actually, employ them in our system. We are also building this into our built in agents that are out there and, are getting to a point where we can actually, do the same kind of questioning across the entire platform that we would do with, you know, Jay z and Bender. We will also get them to the point where they are centrally focused on pulling in data from endpoint detection and response, all of the things that we have out there that should be connected to so that they could have a single point of control, single point of, management and a a path to escalation. The one thing I'd like them to improve, frankly, is get out there and actually escalate better. Call me up in the middle of the night if you've got a higher critical that you've gone through two rounds of triage on. And, oh, yeah, this is a bad thing. But that's gonna happen. Somebody's gonna ring the bell and and, and answer that question for me soon. But, again, think think about what you need to be in have in place. Right? OWASP, AgenTek, AI is producing some really good threat modeling, and we have a product called Praxin that we're actually going to be introducing threat modeling into it. It's actually an open source. I can't say it's ours, but it's an open source platform that we've, grown, that does agentic testing. It does, now does threat modeling, and we're going to be releasing that very soon. Don't tell Steve I I I said that because he, he he might hunt me down for for giving out prerelease information. But go out there, NIST framework, MITRE Atlas, all of those apply. Use them in what you're doing and how you're doing it to identify those elements. We're also looking at something called Observer that actually, produces the telemetry for the agents in your system, agents on your desktop, and actually gives you an answer, associated with what are the bad things that they might, potentially be doing. Oh, by the way and it does feed directly into, my sim some Exabeam. So NuScale. Let's see. Oh, with that, forty three minutes in, I can stop talking now, get a drink of water, and, maybe start answering some questions. You, Kevin, for a great presentation. While you're sipping your water, there are two questions, in the chat. I don't think you answered the first one. Sorry. Three. Did you answer how what did the 25 tokens cost you? Did you answer that for Jody? I I did. That was that was literally a a buck 75. 25 tokens at 7¢ apiece. You do the math. It's pretty close to a buck. 75. And then Cool. Cool. how how many agents do I have? I have just the two, that are stand alone so that that are following this BYOAI, pattern. But inside of the tool, I have a a a a series of analysts that help answer questions inside of the SIEM. Right? So I have a threat detection analyst. I have a outcomes navigator analyst. I have, what's coming soon is something called Supernova. And it is a, an analyst that actually spans the bounds of the entire tool so you don't have to ask questions in different places. You can ask the question once and get it answered across the board. And, the one thing that I haven't talked about yet is, more than just a gleam in my eye. I'm actually building a SOC engineer. And so it'll do things like parsing and go through a process to do integrations. It will find things. And by the way, it's doing those things for the human in the loop, not for the tool itself. Right? So if I were to go out and tell it, go go look at the raw logs associated with, anything associated with the ChatGPT enterprise. It will go out there, and it will, clean up and present that data back. It doesn't need it to be parsed. It doesn't need it to be thought through. But it does consider that if the human didn't parse it, it probably isn't important to the human. And so you have to be very specific about the questions that you ask. Cool. I think it dives into the next question a little bit. So Srivalli was actually asking, you know, is, could you please elaborate on SOC workflows that you implemented, to kind of, understand how these agents are working in the SOC? Sure. Shravalli, if you wanna expand on your question a little bit, because I did talk about things like okay. So if the agent goes out there, sees an alert that, hasn't been risen to the level of a case but is deemed, critical, high, or associated with a a series of attack patterns that it's going to see and it pulls the threads and sees that there are three or four things that are related to an attack pattern, it can automatically create a case that says, I'm seeing these five things occur, these four things occur, and create a, case that that will then pop up and be something that we will almost automatically pay more attention to and, begin, validating whether this is something that's truly a problem or something that we can, bypass. But if you wanna expand on your question a little bit, I I'm happy to drill into how we operate more. Oh, yes. Srivali. Yeah. You can read that, Kevin? Yes. I can. Okay. So thanks. for Volley. You you had said, yes. I have a SIM. I do have all of these elements, and I can I can single thread those elements? Okay. So, you know, tell me, the tenable results for this server, and it's impacted because of why. The other thing is, to to me, that doesn't add a lot of value. You know, I talked about context earlier. Context in this case would mean that the digital worker, SOC analyst level one, level two, level three actually has all the tools to put together the complete picture, right, and be able to, pull these things together into a single view, and then expand those so that it can actually say, this is a bigger problem, and here's why. And it will show you the full context. Without the context, a lot of the times, that's where your SOC analyst level one, level two are hopping system to system to actually build and see those patterns when these digital analyst, digital workers automatically do that, as part of their their, harness or their makeup. It's thank you for that. It's it's a lot of fun, actually. It's, it really opens your eyes to the potential of AI. I I I know a lot of SOC analysts, SOC engineers are are going out there and saying, holy crap. You know? This is this is potentially going after my job. And and and it's not. It it's going to change your job. You know? What what are the things that are, you know, that that make up the human aspect of it? It's critical thinking, Unless something has changed, agents, digital workers don't really do critical thinking yet. Can it put together context? Can it learn? Absolutely 100%. I I would think that, those folks that are, m s SP providers would actually be investing investing in this kind of technology, as an example, to go out there and say, okay. So now I don't have to hire a SOC analyst level one or level two. I can go out there and hire somebody that is what we consider to be an AI wrangler. And their job is critical thinking, critical skills, and asking the right questions as they're going through this and being cynical. You know, going out there and and asking the question in a way that makes the agent question whether it was correct. And if it can go back to the facts and show that there are truly incidents that occurred and these elements all tie together through this stream and can do it at machine speed, you can actually start thinking about how can I defeat that army of agents that are sitting in the well, I'd I'll I'll tell you one more story? I was I was reading my my my threat feed, and, you know, they were talking about how somebody had, used a a clawbot to go out there and attack a, company. Well, they said it it was limited to eight threads. And, you know, there there was eight additional agents is what they is the way they described it. And to me, I was like, okay. So that's the eighth thread limitation of Clawbot. Now if this was a a Quinn model and you had, you know, all the memory in the world to play with all of the the back end's data, stores that are out there, would you be limited to that? No. As many as I can build from a network perspective, I can apply. So hundreds of agents, thousands of agents, hundreds of thousands of agents, and even at some point, millions of agents, all attacking you simultaneously. And how are you gonna defend against that? You're gonna have your own army of folks army of agents that are going out there and protecting the wall, protecting the the the openings that may occur. Leading to that statement, other Kevin, just one question. You know, when you're mentioning about the tax and, you know, agents secure and your own army of agents securing, what are the new risks do you think an an AI agent would bring in into the SOC? The AI agent itself, it it can do things that I'll give you a for instance, and I won't make it a security incident. But but we had a situation where we were monitoring a a guy that was using Claude, using not the enterprise version of Claude, but a a personal version of Claude. And he was vibe coding a MCP server for a connection to a series of devices. And so he said, hey, Claude. Go out and build me an MCP server. Didn't give it a lot of instruction and, you know, what it could use and what it couldn't use. Just let don't go out and do. And so I start seeing things pop into my environment like crewcrew.ai. I'm like, wait. Wait. Where did this come from and why? And so I followed the thread, pulled the thread back a little bit, and I found the person that was actually doing this. And I said, so, Tim, so what what do you need to crew AI for? And he's like, what's crew AI? So he he didn't even realize that that Claude had said, I'm gonna go out there and then pull this in. Now the risk that this generated is CrewAI has a, series of vulnerabilities that are built into the product itself, and it's a bad design, frankly. And and it allows remote code execution, things like that. And so because of that, we ended up blocking it and watched Claude go out and try to, figure out, okay, what else can I can I pull in? What are the threads can I pull in, to actually create this MCP server? It eventually was successful and used the standard tools that we have, the standard methods, but didn't fall back and and do the lazy thing, which was, you know, pulling something that was already in play in place. Does that answer your question? Yep. Good example. Thanks, Kevin. Fantastic. Any other questions? I don't see any more questions from the team here. So great parting words, Kevin? If you are a resistor to AgenTic AI, plea please don't be. It it it will become a useful tool, a useful part of your day. It is going to be something that that helps you answer questions faster, smarter, more efficiently. Begin trusting it because you want to be able to allow these agents to react at machine speed. I I think I've spoken maybe too much about the potential threats associated with, what could be introduced through, agentic by by bad actors. And so but but be ready to accept and and acknowledge the use of this. And don't think about the the the the changes that are gonna going to occur in your life, but talk talk about think about the things that are gonna become, improvements. Right? So the the the fact of the matter is nobody likes to sit on an instant response call for an hour and a half while you are sweating whether or not this is actually a problem for you. You wanna be able to get quick, fast answers and be able to attack the problem as quickly as possible and as, rapidly as you can until we get to a point where the machine is going to be taking it for you. With that, thank you very much. Again, I'm Kevin Kirkwood. I'm the chief information security officer. You can reach me on LinkedIn. I'm happy to connect, specifically with, folks that are security practitioners. Love love talking to y'all guys. Look forward to it. Thank you. Thank you, Kevin. It was a pleasure to host you, for this session. With that, everyone, it's a wrap. Thank you so much for being an amazing audience today. We hope, we will see you again in the upcoming webinars. Do remember to register for the next sessions coming up. September 2, we will have how to manage the nonhuman insider, securing your age of agentic AI. And on September 15, we will actually discuss how to build a modern insider threat program, catching the rogue agents in action. So with that, see you soon, and thank you so much for being a wonderful audience for Kevin and us today. Take care. Bye. Thank