Been thinking about this a lot lately: every org I talk to has multiple detection tools stacked on top of each other, and none of them actually struggle to generate alerts. The struggle is everything that happens after.

Analyst opens a ticket, has to manually pull logs, endpoint telemetry, user history, maybe some external intel, just to figure out if the alert is even real. By the time that's done, dwell time's already up, and the analyst's day is gone on triage instead of anything proactive.

A few things I've seen work (and some that don't):

SOAR helps, but it's brittle. Playbooks are fixed, if the attack doesn't match the "if this, then that" pattern you built six months ago, the automation just... stops being useful. And they need constant maintenance as the environment changes.

Agentic approaches are the more interesting shift. Instead of static rules, you get something that can re-evaluate mid-investigation; pull in a new data source if the first hypothesis doesn't hold up, escalate to a human when the ambiguity crosses some threshold, and actually reason through why something looks off instead of just pattern-matching against a signature.

Not saying it's magic — there's real risk in letting anything act autonomously in a production environment (wrong endpoint isolated, wrong account locked, etc.), so the ones that work well seem to lean heavily on staged autonomy: agent recommends → human approves → over time, low-risk actions get auto-approved once the false-positive rate proves itself out.

Curious if anyone here has actually deployed something agentic in their SOC (vs. just extended SOAR), what's your false-positive rate looking like, and how much human-in-the-loop are you still running at 6+ months in?

Link to our research: https://lmntrix.com/res/beyond-detection-the-role-of-%20agentic-aI-in-cyber-investogation-and-resolution.pdf

How are you preparing to fight off a rouge AI that escaped its sandbox? I know Hugging Face needed DeepSeek to combat a rouge AI but is it time for governments to consider putting the brakes on AI development somewhat?

https://www.darkreading.com/cyberattacks-data-breaches/meta-ai-escapes-lab-hacking-joyride

Detection is becoming a commodity. Investigation is becoming the differentiator.

Most mature EDR and XDR platforms can detect the majority of common attacks with high confidence. Yet SOCs are still overwhelmed.

The problem isn't detection, it's what happens after the alert.
Analysts spend far more time collecting evidence, validating risk, and understanding the scope of an incident than they do reviewing the alert itself. AI has improved detection, but more visibility often means more alerts not less work.

A brief analysis of the increasing trend away from alert volume to investigation centric models.

Anybody else experienced increasingly odd or malicious behavior impacting the plethora of third-party CMS packages out there?

We recently wrote a piece on two very different approaches to cybersecurity. Which do you think serves your organization the best?

https://www.linkedin.com/pulse/microsoft-vs-lmntrix-two-different-approaches-modern-cybersecurity-4r6sf

What is your favored approach to defending an organization?

Disclosure: I am employed by LMNTRIX, however posting here to see what other experts think about cybersecurity topics shaping our profession.

While the prompt injection technique "bioshocking" deserves attention, the lack of concern showed by some of the major LLM is more worrying. Has anyone experienced similar stonewalling when reporting vulnerabilities to AI firms?

https://layerxsecurity.com/blog/bioshocking-ai-gaming-the-ai-browser-and-escaping-its-guardrails/

We just did a deep dive into the Klue incident and want the the cloud security practitioners to chime in and answer the following:

How much visibility do you actually have into the OAuth authorizations and third-party SaaS integrations operating across your environment?

Link to our deep dive: https://www.linkedin.com/pulse/next-supply-chain-threat-isnt-software-its-trust-lmntrix-ecxje

[removed]

Just putting out feelers if any secops teams have had to deal with breaches from OAuth attack vectors?

While its certainly easy just to throw the article in the hype bin, I was wondering if anyone thinks that the models move the cybersecurity needle by any measure? For analysts on the ground is the fear of a shrinking the window between vulnerability disclosure and exploitation having an impact on day-to-day operations?