How to Assess Agentic AI Claims in a SOC

Summary

The interview discusses evaluating agentic SOC claims through evidence, confidence, real-world value and human empowerment, alongside examples of event security monitoring and analyst training.

Key points

• The speaker recommends checking what an AI agent actually does, what evidence supports its output, its confidence level, and whether it solves a real-world problem.
• The interview describes using agents to help train new SOC staff while supporting more experienced analysts.
• The speaker says event staff found a student device infected with malware and making download requests, then worked with network operations and the event team to notify the student.
• The event's monitoring included a perimeter firewall, Splunk Enterprise Security telemetry and Firepower; the speaker says this helped identify the infected student.
• The speaker says bots scan networks and describes POP3 email use as a security concern, but provides no technical details about the email claim.
• The stated operating principle is that agents prepare, humans decide, and evidence supports decisions.

Products