This week at a glance
The through-line this week is that the SOC’s biggest constraint is the data underneath its detections, not the detections themselves. The SANS 2026 Threat Hunting Survey, 500 practitioners and leaders across four regions, found that for the first time in the survey’s history data quality or quantity (50%) outranks the shortage of skilled staff (45%) as the primary barrier to hunting — up from 41% last year and 34% in 2023. Measurement is going the wrong way too: only 40% formally measure hunt effectiveness, against 64% in 2024, and only 11% report a security improvement of 50% or more from hunting, against 47% in 2022. Conifers’ analysis of 14,652 detections across its own customer base lands on the same diagnosis from the engineering side: 47% of detections in an average organisation need fixing, only 63% of known threats have operational defences, and the two failure modes are logic bugs that stop a rule from ever firing and telemetry that quietly stopped flowing. Read Conifers as vendor research on its own customers, but the failure modes are ones you can check for in an afternoon.
Microsoft’s answer to the data problem is commercial. Its Integrated Security Operations Center, in public preview since 23 September, puts Sentinel’s SIEM, Defender XDR, threat intelligence and automation into one workspace, gives Microsoft 365 E5 and E7 customers the SIEM capability at no extra licence cost, and charges nothing to ingest data from Microsoft’s own security products. Everything else — the third-party telemetry that the SANS and Conifers findings say is where coverage breaks — is $2.40 per GB pay-as-you-go from 1 October. Greyhound Research’s Sanchit Vir Gogia puts the caution in one line: 500 connectors “establishes reach, not equal treatment of every source.” Around it, the agentic-SOC platforms keep arriving — Splunk’s .conf26 agent controls, SentinelOne’s Wayfinder hunting extended to AWS, Azure and Google Cloud — against a Gartner projection, cited in a Prophet Security-sponsored piece, that 70% of SOCs will pilot AI agents by 2028 and only 15% will see results.
The second thread is agents as both the tool and the thing to watch. Exabeam doubled its AI-focused behavioural detections from 45 to 90 and added Anthropic Claude to the AI platforms it monitors; Cloud Range launched a range for testing AI agents and human defenders on the same scenarios, without results yet; and OpenAI’s alignment team documented a class of prompt injection that copies itself through email, the filesystem and code comments, found by internal red-team models and not observed in the wild. On the remediation side, Palo Alto’s Unit 42 Continuous Frontier AI Defense runs gated cyber models continuously across an estate — with the sobering internal finding that no single model caught more than 40% of vulnerabilities and two frontier models overlapped less than 10% of the time — while Vicarius’ ScriptAI drafts OS-level fixes for flaws with no vendor patch, validated by its own researchers before execution. And two hygiene items give you something concrete to do this week: Unit 42 research documenting how AWS quarantines exposed IAM keys, and GitHub’s SSH deprecation calendar starting 14 October.
On our watch list
- Microsoft ISOC’s two preview dates, 1 October and 15 November. Third-party and outside-source data starts billing at $2.40 per GB pay-as-you-go on 2026-10-01; retention rises from 30 to 90 days, and existing Sentinel customers can begin transitioning, on 2026-11-15. The preview excludes organisations with an active Sentinel workspace, so the first real test is what the transition terms look like for them. Until then, price your non-Microsoft telemetry at $2.40 per GB before anyone calls the SIEM free.
- GitHub’s SSH changes, starting 14 October. From 2026-10-14 new RSA keys must be at least 3072 bits and the post-quantum
mlkem768x25519-sha256 key exchange is enabled; brownouts of ssh-rsa (SHA-1) and diffie-hellman-group-exchange-sha256 follow on 2026-11-04 and 2026-12-09 ahead of final removal. The final-removal date on GitHub’s changelog should be confirmed on the page itself before you put it in a change calendar. The brownouts are the dates that will break old clients and CI runners first.
- Whether hunt measurement recovers from 40%. SANS found only 40% of programmes formally measure hunt effectiveness, down from 64% in 2024, and only 37% follow a formal methodology such as PEAK or TaHiTI. Data has now overtaken skills as the top barrier for the first time. If next year’s survey shows measurement still falling while data complaints rise, the problem is not hunters but the pipeline feeding them.
- The first published results from Cloud Range’s AI Validation Range. The range is built to test AI agents and human defenders on the same scenarios, using a five-step PROVE process, but the launch included no benchmark results, customers, pricing or availability date. Nothing yet shows how any agent performed against humans. The first published comparison, and who ran it, is the thing to wait for.
- Independent replication of Palo Alto’s model-overlap finding. In Palo Alto Networks’ own testing, no single model caught more than 40% of vulnerabilities in a complex environment, and findings from Claude Mythos 5 and GPT-5.6-Cyber overlapped less than 10% of the time. That is internal testing, not an independent result. If a third party reproduces it, single-model AI testing becomes hard to defend; if not, treat it as the vendor’s argument for its multi-model harness.
- The first in-the-wild self-replicating prompt injection. OpenAI’s report describes injections that propagated through email, the filesystem, code comments and multi-hop Slack reads, including one that removed
security-scan steps from a package.json build config. Everything observed was on internal research checkpoints in OpenAI’s highest-security clusters. Watch for the first report outside a lab, and for whether other model providers add self-reproduction to their red-team objectives as OpenAI has.
- What “only 15% will see results” means for your pilot. Gartner projects that 70% of SOCs will pilot AI agents by 2028 and only 15% will see results. The figure reached this week’s feeds through a Prophet Security-sponsored article; the projection itself is Gartner’s. Watch whether your own pilot has written exit criteria before it starts, because the 15% is the number it will be judged against.
- Evidence behind Vicarius’ timing claims. Vicarius says ScriptAI takes under an hour against weeks for manual remediation, and cites a mean time to exploit of negative eight hours in July 2026, down from 53 days in 2024. Neither figure came with a cited source. Watch for customer-measured remediation times, and treat the time-to-exploit figure as context rather than data until its origin is published.
- Project Perception leaving invitation-only preview. Microsoft’s agent strategy for security operations, introduced in July 2026, remains invitation-only in limited public preview while ISOC opens broadly. The agent layer is where Microsoft’s SOC pitch will be judged, and it is not yet generally available to test.
- Whether agent-monitoring vendors publish anything beyond rule counts. Exabeam doubled its AI-focused detections from 45 to 90 and mapped them to the OWASP Top 10 for Agentic AI, with no accuracy or coverage figures. Conifers’ report argues that counting rules overstates protection. The first agent-behaviour product to publish a coverage or precision measure, rather than a detection count, will set the bar for the rest.
- Vendor-locked detections, and who fixes them. Conifers notes that security teams cannot edit many of the detections shipped inside endpoint platforms, cloud tools, identity providers, email gateways and network sensors. Watch whether vendors start exposing detection health for the rules they control — until they do, those rules are the part of your coverage you can neither test nor repair.
This week’s topic map — detection coverage and the telemetry beneath it (the SANS threat-hunting survey, Conifers’ coverage-gap report and Microsoft’s Integrated SOC with Sentinel and Defender XDR), agentic SOC platforms against Gartner’s pilot projection, monitoring and testing AI agents (Exabeam, Cloud Range and OpenAI’s self-replicating prompt injection), AI-found flaws and automated remediation (Unit 42 Continuous Frontier AI Defense and Vicarius ScriptAI), AI incident-response readiness, and credential hygiene from AWS key quarantine to GitHub’s SSH deprecations.
View interactive topic map →
Article index
Detection coverage and the data underneath it
Rule counts and dashboards overstate protection when telemetry is patchy. A practitioner survey and a vendor’s own customer analysis reach the same conclusion from opposite ends, and Microsoft’s pitch this week is precisely to make ingestion of its own telemetry free. Conifers originated two of these four rows — the coverage-gaps report and the contributed piece by Jonathan Waknin — so weigh them as one vendor’s view.
Agentic SOC platforms
The platform vendors’ agent roadmaps, and the counterweight to them. The Gartner row is a Prophet Security-sponsored article bylined to Augusto Barros; the 70%/15% projection to 2028 is Gartner’s, and the other figures in the piece are not. SentinelOne’s row is its own press release.
Watching the agents themselves
Once agents run inside the business, the SOC has to observe them like any other identity. Three of these four are vendor-authored: Token Security’s Itamar Apelblat on lateral movement, Intezer’s Nicole Fishbein on AI alert volume, and Abnormal AI’s suite announcement. Intezer’s own data is the reality check: AI-related alerts rose 685% from February to June 2026, but 94.1% were noise and 0.02% real attacks.
Testing and benchmarking agents
A range to test agents against human defenders, a view on where breach and attack simulation goes next, and the threat model both should be testing against: OpenAI’s research on prompt injections that replicate themselves. The Cloud Range row is a vendor announcement with no results yet.
AI incident response readiness
The playbooks lag the adoption. ISACA’s figures come from the European respondents to its 2026 State of Cyber report: 71% have not run an AI incident-response exercise and 3% have mature AI runbooks. Gartner’s deepfake figures come from its AI-driven Social Engineering Attacks report. The Dark Reading row is labelled commentary by Jerry Bui of Purpose Legal.
AI-found flaws and automated remediation
Three answers to the same volume problem: find continuously, script a fix before the vendor ships one, and pre-approve low-risk automated fixes with a human on the loop. The SecurityWeek row is contributed by Nadir Izrael of Armis, a ServiceNow company.
Credential and platform hygiene
Two items that hand the SOC something concrete: a CloudTrail event to alert on when AWS quarantines an exposed key, and an SSH deprecation calendar that will break old clients. The AWS row is Unit 42 research on a long-standing control, not a new AWS launch.
Adoption surveys
Context rather than SOC craft: KPMG’s Q3 2026 Global AI Pulse, 2,131 senior leaders in 20 countries. Read it alongside the ISACA readiness figures above.
Detailed write-ups
1. Microsoft folds Sentinel into Defender, and makes its own telemetry free to ingest
CSO Online · September 24, 2026
Microsoft’s Integrated Security Operations Center (ISOC) combines Sentinel’s SIEM with Defender XDR, threat intelligence, automation and AI tooling in a single workspace. It entered public preview on 2026-09-23 with no minimum seat requirement. The licensing is the headline: Microsoft 365 E5 and E7 customers get the SIEM capability at no extra licence cost, and data from Microsoft’s own security products carries no ingestion charge. Third-party and outside-source data is billed at $2.40 per GB pay-as-you-go from 2026-10-01. The workspace needs an Azure subscription and unlocks more than 500 data connectors. Retention is 30 days during preview, rising to 90 days on 2026-11-15.
Rob Lefferts, Corporate Vice President for Microsoft Threat Protection, frames it as an architecture argument: “Security cannot operate at AI speed when protection and operations are built as separate systems.” Two limits matter for anyone already running Sentinel. Organisations with an active Sentinel workspace are excluded from the current preview; existing customers see no immediate change and may transition from 2026-11-15. And Project Perception, Microsoft’s agent strategy for security operations introduced in July 2026, remains invitation-only in limited public preview — so the agentic layer is not what is being opened up here.
Read “free SIEM” precisely. It applies to Microsoft-sourced telemetry, and the third-party sources that the week’s coverage research says are where detection breaks are exactly the ones that are billed. Greyhound Research’s Sanchit Vir Gogia is sceptical of the connector count — “500 connectors establishes reach, not equal treatment of every source” — and advises reproducing your highest-value cross-vendor detections before replacing a mature SIEM. That is the right test. Pick the five detections that depend most on non-Microsoft data, price their ingestion at $2.40 per GB, and rebuild them in the preview before any migration decision. This is a preview, not general availability.
Sources: CSO Online (Microsoft integrates SOC capabilities with Defender for enterprises)
2. Data, not staff, is now the threat hunter’s biggest problem
Help Net Security · September 25, 2026
The SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting, authored by SANS Principal Instructor Josh Lemon and released on 2026-09-23, drew on 500 practitioners and security leaders across North America, Europe, Latin America and Asia. For the first time in the survey’s history, data quality or quantity (50%) outranks a shortage of skilled staff (45%) as the primary barrier. The data complaint has climbed steadily, from 34% in 2023 to 41% last year to 50% now. The other barriers are budget (42%), lack of data standards (39%), tool limitations (37%) and lack of defined processes (36%).
The measurement figures are the uncomfortable part. Only 37% of programmes follow a formal hunting methodology such as PEAK or TaHiTI. Just 40% formally measure hunt effectiveness, down from 64% in 2024. And only 11% report a security improvement of 50% or more from hunting in the past year, against 47% in 2022. These are not first-year programmes: 82% of respondents have been hunting for at least two years. Cloud infrastructure is the hardest environment to hunt in for 32% of respondents.
Lemon’s summary is the operational point: “You can be the most capable hunter in the room and still come up empty if the telemetry you’re working with is incomplete, inconsistent, or scattered across a dozen tools.” The practical order of work follows from it. Before adding hunters or hunt hypotheses, inventory which data sources your last ten hunts actually needed and whether each was complete for the period hunted. If you are in the 60% that do not measure effectiveness, adopt a methodology with a built-in measurement step before the next quarter’s hunts, not after.
Sources: Help Net Security (Half of threat hunters say bad data is their biggest problem)
3. Deployed is not protected: the coverage gap behind the dashboard
Help Net Security · September 25, 2026
Conifers, an AI SOC vendor, published a report with DTX involvement based on analysis of 14,652 threat detections across its customer environments. Its headline finding is that 47% of detections in an average organisation need fixing. Only 63% of known threats have operational defences, and 64% of relevant MITRE ATT&CK techniques are protected, leaving roughly a third without reliable detection. This is vendor research on the vendor’s own customer base, not an independent sample, and Conifers also authored this issue’s “The SOC Doesn’t Need to Start Over with Every Alert” — but the mechanisms it names are testable in any SOC.
The report names two failure modes. Logic bugs are detections that run but never fire, because of a wrong operator or broken parsing. Missing telemetry is the data source that stopped flowing, was never onboarded, or changed format. Neither shows up on a dashboard that counts deployed rules, which is the report’s point. Tom Findling, Conifers’ CEO: “For years, the industry has measured detection strength by counting rules and tools. But deployed is not the same as protected.” A further complication is that security teams cannot edit many vendor-controlled detections — the ones shipped in endpoint platforms, cloud tools, identity providers, email gateways and network sensors.
Two checks follow. For logic bugs, every custom rule needs a test event that should trigger it, run on a schedule, so a rule that silently stops matching is caught. For missing telemetry, alert on the absence of expected data per source, not only on its content. Read this alongside the SANS data and the Microsoft ingestion pricing: all three point at the pipeline, not the rule library, as where coverage is actually lost.
Sources: Help Net Security (Threat detection dashboards are masking security coverage gaps)
4. Palo Alto’s continuous AI testing, and the finding that no one model is enough
Axios · September 22, 2026
Palo Alto Networks announced Unit 42 Continuous Frontier AI Defense on 2026-09-22, in an Axios exclusive by Sam Sabin and a press release the same day. It extends the point-in-time Frontier AI Defense service launched in April 2026. The service uses gated cyber models — Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6-Cyber — alongside open-weight models, routed through a proprietary multi-model harness. After a full-estate baseline scan, it continuously tests web apps, APIs, cloud infrastructure, source code repositories and network assets, and chains flaws into attack paths. Output is prioritised fixes, code-level guidance and virtual-patch recommendations, and it pairs with Frontier Virtual Patching for flaws with no official patch. It is available worldwide on annual subscription, with pricing that varies by model mix and was not disclosed.
The most useful figures are about the models, not the product. In Palo Alto’s own testing, no single model caught more than 40% of vulnerabilities in a complex environment, and findings from Mythos 5 and GPT-5.6-Cyber overlapped less than 10% of the time. That is internal testing, not an independent result, and it is also Palo Alto’s argument for its harness. But if it holds, the implication for any team using a single AI model for vulnerability discovery is that the result is a sample, not a sweep. Nikesh Arora, Palo Alto’s CEO: “The capability and technology continues to evolve much faster than you can create security for it.”
Despite the Axios headline’s “fight AI hacks”, this is an offensive-testing and exposure-management service, not a detection or response tool. For the SOC, the operational question is the output volume: continuous testing across the whole estate produces a continuous stream of findings, and the team receiving them needs a triage path and remediation owners before the first report lands.
Sources: Axios (Exclusive: Palo Alto Networks’ new service to fight AI hacks)
5. Vicarius ScriptAI writes the fix before the vendor ships one
SiliconANGLE · SecurityWeek · September 23–24, 2026
Vicarius launched ScriptAI on 2026-09-23 for customers of its vRx platform. It generates detection and remediation scripts for vulnerabilities that have no vendor patch. Vicarius researchers validate the drafted logic before execution; the platform then runs the scripts, verifies results and rolls back on failure. Scripts execute as native Bash and PowerShell at the OS level, a deterministic judge — not a language model — validates them, and each ships with a cryptographically signed evidence manifest. Roi Cohen, co-founder and CEO: “If AI can find the vulnerability, AI should help build the protection.”
Vicarius claims the process takes under an hour against weeks for manual remediation, and cites a mean time to exploit of negative eight hours in July 2026, down from 53 days in 2024. Both are vendor claims with no cited source. The design detail worth noting is the human validation step and the non-LLM judge: this is not fully autonomous patching, and it should not be evaluated as if it were. The signed evidence manifest is what makes an OS-level script acceptable to a change-control board, and it is the first thing to ask to see in a trial.
SecurityWeek’s contributed piece by Nadir Izrael of Armis, a ServiceNow company, argues the same direction from the process side: enable agentic remediation by working back from the outcome, pre-approving low-risk automated fixes with a human on the loop. Taken with Palo Alto’s continuous testing, the week gives three linked answers to AI-speed discovery — find continuously, script a compensating fix when no patch exists, and decide in advance which fixes can run without a meeting.
Sources: SiliconANGLE (Vicarius launches ScriptAI to write fixes for flaws with no vendor patch) · SecurityWeek (Begin at the End: How to Enable Agentic Remediation)
6. Exabeam doubles its agent-behaviour detections
TechPartner News · September 21, 2026
Exabeam doubled the AI-focused behavioural detections in Agent Behavior Analytics, on its New-Scale Security Operations Platform, from 45 to 90. Anthropic Claude joins ChatGPT, Gemini, Microsoft Copilot and GitHub Copilot as monitored AI platforms, and Outcomes Navigator now maps detections to the OWASP Top 10 for Agentic AI. Exabeam Nova Rules Creator builds detection rules from natural language and converts Sigma rules. Observra is a new open-source telemetry-layer project for AI agents, following Praxen, an open-source agent behaviour verification tool released earlier. The update also adds phishing email ingest and custom REST API context collection, and expands LogRhythm SIEM integrations across Microsoft, cloud, identity and email sources.
Pete Harteveld, Exabeam’s CEO: “Security teams need visibility not only into human activity, but into how agents behave, interact, and make decisions.” The direction is right — agents acting on behalf of employees are identities with behaviour, and they belong in the same analytics as users. The coverage announced is a list of AI platforms monitored and a count of rules.
That count is exactly the trap the Conifers report describes: “doubled to 90 detections” is a rule count, not a coverage measure, and the announcement included no pricing, availability dates or detection-accuracy figures. If you evaluate it, ask which of the OWASP Top 10 for Agentic AI categories each of the 90 detections covers, and what telemetry each requires from the monitored AI platform — the missing-telemetry failure mode applies to agents as much as to endpoints.
Sources: TechPartner News (Exabeam expands platform to detect and monitor AI agent behaviour)
7. A prompt injection that spreads like a worm
OpenAI Alignment · September 25, 2026
OpenAI’s alignment team reports a new class of prompt injection that self-propagates. In the report’s words: “We show the existence of a new variety of prompt injection, which can self-propagate akin to a computer worm.” It was first discovered on 2026-06-27 using GPT-Red-style internal red-team models based on GPT-5.4-mini, trained by reinforcement-learning self-play. The observed propagation paths were email (the injection told the agent to copy the prompt into all outgoing mail), the filesystem, and code comments committed into repository files.
The variants read like a detection-engineering brief. One used a fake system warning to make the model delete reports from a finance-reports directory before replicating itself into a file. Another persuaded the model to remove security-scan steps from a project’s package.json build config. A multi-hop Slack variant manipulated a GPT-5.5 agent, through sequential channel reads, into transferring internal currency and reposting the injection across channels. Each of those is an action an agent took with permissions it legitimately held.
Scope matters: every vulnerable and attacking model was an internal research checkpoint on OpenAI’s highest-security clusters, and nothing was observed in the wild. OpenAI’s mitigation is to make self-reproduction an attacker objective in GPT-Red training. For a SOC, the transferable lesson is what to watch: agents writing the same content into many outbound messages, agent commits that modify build or CI configuration, and removal of security steps from pipelines. Those are observable regardless of which model is behind the agent, and they are the scenarios a test range for agents should include.
Sources: OpenAI Alignment (Self-replicating prompt injections exist)
8. Cloud Range builds a range to test agents against human defenders
Help Net Security · September 24, 2026
Cloud Range launched two things: the AI Validation Range and the Cloud Range AI Readiness Framework. The range recreates realistic enterprise environments with licensed security tools and complex traffic generation, and includes a library of automated adversary attack emulations so AI agents can be tested without touching production. The framework runs a five-step PROVE process — Prepare & Train, Risk-Assess, Operationally Test, Validate & Benchmark, Evaluate & Evolve. The stated purpose is to decide which SOC roles suit AI agents and which need human expertise, by testing both on the same scenarios.
Debbie Gordon, Cloud Range’s CEO: “AI is moving from recommending what humans should do to actually doing it, and that fundamentally changes the risk equation.” The launch cites recent incidents of autonomous agents reaching external systems beyond their intended boundaries as the motivation, and that is the right use of a range — boundary behaviour is precisely what you cannot safely test in production.
This is a vendor announcement with no benchmark results, pricing, customers or availability date, and nothing yet shows how any agent performed against humans. The idea is still worth borrowing. Before an AI SOC agent gets write access anywhere, run it and your analysts through the same scenarios and compare — and include OpenAI’s self-replicating injection patterns among the scenarios, since an agent that handles alerts well but copies an injection into its outbound messages has failed the test that matters.
Sources: Help Net Security (Cloud Range lets SOCs benchmark AI agents against human defenders)
9. Two hygiene items with dates: AWS key quarantine and GitHub SSH
GBHackers · GitHub Changelog · September 22, 2026
The AWS item is not a launch. AWS’s mechanism for quarantining exposed IAM credentials dates to August 2020; the news is Palo Alto Networks Unit 42 research documenting how it behaves. In Unit 42’s test, the AWSCompromisedKeyQuarantineV3 policy attached 10 seconds after exposure in a public GitHub repository. Two details make it useful to a SOC. The policy uses explicit Deny rather than disabling the user, so the key is contained but the identity still exists; and it appears in CloudTrail as an AttachUserPolicy event from the IAM service. That event is a high-confidence signal that a key has leaked and should open an incident, because the quarantine limits what the key can do rather than rotating it.
GitHub’s SSH changes come with a calendar. From 2026-10-14, new RSA keys must be at least 3072 bits and the post-quantum mlkem768x25519-sha256 key exchange is enabled. Brownouts of ssh-rsa (SHA-1) and diffie-hellman-group-exchange-sha256 follow on 2026-11-04 and 2026-12-09, ahead of their final removal; confirm the final-removal date on GitHub’s changelog before scheduling against it. The brownouts will surface old clients, build agents and automation that negotiate the deprecated algorithms — better found in your inventory now than as failed deploys on 4 November.
Sources: GBHackers (AWS Detects and Quarantines Exposed IAM Credentials in Public GitHub Repositories) · GitHub Changelog (Security improvements for SSH)
Calls to action
- Alert on AWS key quarantine events today. Write a detection for CloudTrail
AttachUserPolicy events from the IAM service that attach AWSCompromisedKeyQuarantineV3. Route it as an incident, not an informational alert: the policy denies actions but does not rotate the key or disable the user, so the leaked credential still needs revoking and the repository it leaked from still needs cleaning.
- Inventory SSH clients before GitHub’s 4 November brownout. Find build agents, CI runners and automation that connect to GitHub with
ssh-rsa (SHA-1) or diffie-hellman-group-exchange-sha256, and any RSA keys shorter than 3072 bits due for replacement after 14 October. Fix them before the 2026-11-04 brownout rather than discovering them through it.
- Test every custom detection for the two Conifers failure modes. For logic bugs, attach a scheduled test event to each custom rule so one that silently stops firing is caught. For missing telemetry, alert on the absence of expected data per source. Then list the vendor-controlled detections you cannot edit, so you know which part of your coverage you cannot test yourself.
- Price your third-party telemetry before calling the Microsoft SIEM free. If you are an E5 or E7 customer, total your non-Microsoft log volume at $2.40 per GB from 1 October, and reproduce your five highest-value cross-vendor detections in the ISOC preview before any migration decision. Existing Sentinel customers have until 15 November before a transition path opens.
- Put a measurement step into your threat hunting. SANS found only 40% of programmes formally measure hunt effectiveness. Adopt a methodology with a built-in measurement step, such as PEAK or TaHiTI, and for each of your last hunts record which data sources it needed and whether they were complete for the period hunted.
- Add agent behaviours to your detection backlog. From OpenAI’s report: agents writing the same content into many outbound messages, agent commits that modify build or CI configuration, and removal of security-scan steps from pipelines. Each is observable regardless of the model, and each maps to an action an agent can take with permissions it already holds.
- Write exit criteria before starting an AI SOC pilot. Gartner’s projection is that 70% of SOCs will pilot AI agents by 2028 and only 15% will see results. Define up front what result would count, measured on your own baseline, and test the agent and your analysts on the same scenarios before it gets write access.
- Decide which remediations can run without a meeting. If you are evaluating continuous AI testing or pre-patch scripting, agree in advance which classes of low-risk fix can be applied automatically with a human on the loop, who owns the rest, and what evidence — such as a signed manifest and a tested rollback — change control will accept.
- Schedule an AI incident-response exercise. ISACA found 71% of its European respondents have not run one. Include a multimodal deepfake scenario, as Gartner now urges for incident-response playbooks, and an agent-compromise scenario, and check that your playbook preserves forensic evidence rather than going straight to containment.
|