Detailed write-ups
CrowdStrike Signal: Automated Leads (May 11)
Entity-scored detections in Falcon: indicators are tagged to a host or identity rather than treated as binary alerts, scores accumulate across events, and the engine surfaces “zero detect” clusters — suspicious behavior groups that wouldn’t trigger any single high-confidence alert. Direct attack on alert fatigue.
Sources: CrowdStrike Blog
Elastic drops the “SOAR tax”
Elastic Workflows ships native automation built directly into Elastic Security, with access to alerts, cases, and investigation data without a separate SOAR product. Worth modeling against your current SIEM + SOAR licensing if Elastic is in your stack.
Sources: StockTitan
Splunk + Cisco ship six specialized AI agents and ES 8.2
Six purpose-built agents for Splunk Enterprise Security: Detection Builder, Triage, Guided Response, Standard Operating Procedures, Malware Threat Reversing, and Automation Builder. Two new agentic SKUs (Essentials and Premier) ship in Splunk ES 8.2, with most agents in alpha/prerelease through June 2026.
Sources: ChannelE2E
Netskope AI agents for SOC and NOC
Netskope One AgentSkope is an agentic AI framework designed to automate security and network operations workflows — alert triage, investigation, response. Notable for unifying SOC and NOC under a shared agentic substrate.
Sources: Network World
SANS: State of Detection Engineering 2026 (May 11)
SANS webcast on detection accuracy, Detection-as-Code adoption, workflow automation, and the role of AI in SOC operations. Frame against the Conifers and Intezer-style maturity models for an honest baseline conversation in your team.
Sources: SANS Institute
Help Net Security: AI SOC vendors are selling a future production hasn’t reached
A useful counterweight to the vendor noise: a lot of marketed agentic-SOC capability is not yet operational in production environments. Read before signing a multi-year agentic-SOC commit.
Sources: Help Net Security
iOS 26.5 + Android Intrusion Logging
iOS 26.5 brings default E2E-encrypted RCS between iPhone and Android, based on the MLS protocol in RCS Universal Profile 3.0; a lock icon indicates encrypted threads. Android’s new opt-in Intrusion Logging in Advanced Protection captures daily device and network telemetry in E2EE logs stored on Google servers, built with Amnesty International and Reporters Without Borders for high-risk users. Both updates have IR-playbook implications for mobile forensics.
Sources: The Hacker News (iOS 26.5) · The Hacker News (Android Intrusion Logging)
|
