This week at a glance
This week the SIEM market argued about who owns the data layer. Cribl, which built its business routing telemetry into other vendors’ SIEMs, launched Cribl Detect on IP from its CardinalOps and Radiant Security acquisitions. It is priced at roughly $18,000–$20,000 per TB per month on the infrastructure it runs on rather than on ingestion or queries, runs federated search against data where it lives, and translates existing Splunk and Sigma rules. It is cloud-only for now, and a Fortune 50 engineer quoted by TechTarget calls the migration “a real project, not a switch.” Vega II makes a similar pitch from the AI side: its gateway streams any source into low-cost object storage, a post-trained model runs the detection and triage loop, and a memory layer keeps what it learned about the environment. Raffael Marty’s market column puts both alongside Microsoft’s ISOC and argues the boundaries between SIEM, AI SOC, data pipeline and MDR are collapsing into “the full loop.”
The second thread is agentic investigation leaving the demo stage. The Options Clearing Corporation built a SOC Agent on Amazon Bedrock that runs analyst-style investigative loops over its SIEM data; Leidos launched UpHold Effect for federal SOCs with configurable autonomy and an audit record of every recommendation; Exabeam turned Nova into a persistent investigator and added Claude-based skills; and Splunk set out its trusted agentic SOC model, where the analyst still validates the evidence and approves the action. Every one of them leans on the same phrase — humans in control — and none published outcome numbers. Swimlane’s survey of 500 US and UK security workers gives the staff view: 62% say AI helped them build skills, while 47% expect SOC analyst jobs to get harder to land.
The third thread is a reminder that the bottleneck is downstream of detection. Cisco’s survey of 8,000 security professionals found just 21% can deploy a new security control within six months of approval, and 40% of teams spend more time collecting and matching data than hunting. Detectify’s data on 1,293 customers found 86–97% of open critical and high findings had been exposed for 90 days or more, and a Dark Reading column argues that is an ownership problem a scanner purchase cannot fix. Meanwhile offensive validation is attracting the money: Kevin Mandia’s Armadin raised $255.5M at a $2.5B valuation for agent swarms that chain vulnerabilities, and RemoteThreat raised $7M to test what happens after the first compromise. The foundational reading this week is practical hunting craft: falsifiable hunt hypotheses, SAML forgery detection, decoy accounts and an OAuth backdoor that survives token revocation.
On our watch list
- Cribl Detect’s first production migrations. Cribl claims up to 50% savings against existing SIEMs, and analysts quoted by TechTarget say assisted Splunk and Sigma translation still needs validation and tuning. The proof point is a named customer that has moved its detections across and reports what broke. Also watch for the on-premises and self-managed options Cribl says it is considering.
- Published accuracy for Cribl’s SecIT Bench. Cribl’s first run tested 20 models on 30 IT and security investigations and found a 17% accuracy spread against a 20-times cost range. Omdia’s Torsten Volk says StreamAI’s impact now depends on how accurate that benchmark is; independent replication would confirm or falsify it.
- Outcome numbers from OCC and Leidos. Neither OCC’s Bedrock SOC Agent nor Leidos’ UpHold Effect launch included a single metric. The first disclosure of investigation time, escalation rate or analyst override rate from a regulated operator would be the most useful agentic-SOC data point of the quarter.
- Microsoft ISOC’s 15 November date. Existing Sentinel customers can begin transitioning to the Integrated SOC from 2026-11-15. BlueVoyant’s deployment service is the first partner offer built around that rollout; watch for others, and for what transition terms Microsoft gives customers with an active Sentinel workspace.
- What Armadin ships for $445M. Armadin has now raised more than $445M across a $190M Series A in March and this $255.5M Series B, with In-Q-Tel among its backers. It has named no customers. Watch for the first customer references and for how it reports agent-found attack chains, against established breach and attack simulation tools.
- Whether continuous attack testing shrinks the backlog or grows it. Armadin and RemoteThreat both promise to find more chained weaknesses. Detectify already shows public-sector organisations resolving only 8.3% of critical and high findings within 90 days. If more findings simply join the queue, the ownership argument in this week’s Dark Reading column becomes the deciding factor.
- Independent data on the SOC career ladder. Swimlane’s respondents are positive about AI, but 47% expect analyst roles to get harder to obtain and leaders report taking on more work than practitioners (52% against 36%). A non-vendor survey of entry-level hiring would confirm or falsify the worry.
- Cisco’s six-month deployment gap. Only 21% of respondents can deploy a new control within six months, against 52% of the top tier. Watch whether agentic platforms are sold on closing this gap, and whether anyone measures it before and after.
- Agent telemetry becoming standard SIEM content. LogRhythm added collectors for ChatGPT, Gemini and GitHub Copilot activity feeds; Splunk shipped an alpha NIST AI RMF control coverage dashboard; Exabeam correlates Claude Enterprise prompts, tool calls and actions. Watch for rival SIEMs shipping the same collectors out of the box.
This week’s topic map — SIEM economics and the data layer (Cribl Detect, Vega II, Microsoft ISOC and BlueVoyant), agentic investigation in production (Exabeam Nova, OCC on Amazon Bedrock, Leidos, Splunk) with humans kept in control, the SOC analyst career ladder (Swimlane), offensive validation (Armadin, RemoteThreat), the vulnerability backlog and remediation ownership (Cisco, Detectify), and hypothesis-driven hunting.
View interactive topic map →
Article index
SIEM economics and the data layer
Who owns the telemetry, and who charges for it. Cribl’s launch is covered independently by TechTarget; the Vega II row is a vendor announcement published under Help Net Security’s Industry News byline; the Security Boulevard row is Raffael Marty’s syndicated market column; BlueVoyant’s service is built around Microsoft’s Integrated SOC rollout.
Agentic investigation in production
Agents doing investigative work on real SIEM data, each framed around keeping analysts in control. The OCC and Leidos rows are press releases with no published metrics; the Splunk row is a Splunk blog setting out its own model.
The analyst role
How SOC staff feel about the change. The survey of 500 US and UK security workers was sponsored by Swimlane, an agentic AI vendor.
Offensive validation
Two funding stories for AI-assisted attack testing: one of the year’s largest security rounds, and a pre-seed bet on post-breach red teaming.
Deployment speed and the vulnerability backlog
The constraint downstream of detection. Both studies are vendor research: Cisco’s survey of 8,000 security professionals across 30 markets, and Detectify’s analysis of 1,293 of its own customers. The Dark Reading row is a contributed column by Nishant Sharma.
Detection content and hunting craft
Splunk’s monthly detection release and four pieces of practitioner method: two SC Media hunting guides that make hunts falsifiable, and CISA’s guidance on decoy accounts and files.
Identity persistence and outsourced response
Two identity attacks that outlast the obvious containment step, and a buyer’s explainer on what managed detection and response should and should not cover. The CSO row is a contributed piece.
Detailed write-ups
1. Cribl moves into the SIEM, priced on infrastructure rather than ingestion
TechTarget · Security Boulevard · September 29, 2026 – October 2, 2026
Cribl Detect is Cribl’s formal entry into the SIEM market, built on intellectual property from its acquisitions of CardinalOps in July and Radiant Security in August. The pricing is the pitch: roughly $18,000–$20,000 per TB per month, charged on the infrastructure the product runs on rather than on ingestion or queries, with Cribl claiming savings of up to 50% against existing SIEMs. “Cribl Detect is priced on the infrastructure it runs on, not on how much you search,” said Nicole Beckwith, Cribl’s Senior Director of Security Engineering and Operations.
Technically, Detect runs federated searches against data where it already sits, without rehydration delays on cold storage, and migrates existing Splunk and Sigma rules through assisted translation and mapping. It is not yet available on-premises or self-managed. Alongside it Cribl unveiled StreamAI, an AI gateway informed by its SecIT Bench: in the first run, 20 models across 30 IT and security investigations showed a 17% spread in accuracy against a 20-times range in cost.
The analysts quoted are measured. Steve Koelpin, a principal AI observability engineer at a Fortune 50 company, says assisted translation makes migration “a real project, not a switch,” and that most large enterprises will not replace a SIEM immediately. Sean Sosnowski of Software Analyst Cyber Research warns that a conversational interface “does not remove the need for complete data, dependable queries, or investigation results that hold up to scrutiny.” Raffael Marty’s column on Security Boulevard places the launch in a wider pattern — Microsoft’s ISOC, Vega II, Scanner’s federated indexing, Quorum Cyber’s acquisition of Ontinue — and concludes that “the new competitive surface is the full loop: data, context, detection, investigation, memory, policy, and action.”
Sources: TechTarget (Cribl targets SIEM data costs with new Detect tool) · Security Boulevard (The Security Operations Market Is Moving From Narrative To Execution)
2. Vega II: a security-trained model with a memory
Help Net Security · September 29, 2026
Vega II is Vega’s largest platform release since it emerged from stealth. It has three parts: a proprietary model post-trained for agentic cyber-defence work, which runs detection, triage and investigation loops; Vega Memory, which retains the ground truth of the environment and the actions taken so context carries from one investigation to the next; and Vega Gateway, which streams data from any source over OpenTelemetry, webhook or API into low-cost object storage, onboarding in minutes without legacy connectors.
The argument is that analytics should reach sources that never fitted into a traditional SIEM. “AI gave attackers a head start. It doesn’t have to give them the future,” said CEO Shay Sandler. This is a vendor announcement with no customer results or pricing; treat the persistent-memory claim as something to test on your own data, including what the memory retains and who can correct it when it is wrong.
Sources: Help Net Security (Vega II brings security-trained AI and lasting memory to the SOC)
3. Exabeam makes Nova a persistent investigator, and LogRhythm learns to watch AI tools
SiliconANGLE · October 1, 2026
Exabeam’s update moves its New-Scale platform toward agent-driven investigations. Nova now acts as a persistent investigator across the platform, collecting context and running follow-up searches as an incident develops. Related Cases, in early access since July, groups connected incidents automatically. A Guided Investigation Skills Pack brings Claude into command-line agents for natural-language triage, and Claude Enterprise customers get a single timeline of prompts, tool calls and actions with behaviour-based correlation.
On the LogRhythm side, Exabeam added out-of-the-box collectors for ChatGPT, Gemini and GitHub Copilot activity feeds and moved the product from Elasticsearch to OpenSearch. It also open-sourced an Agentic SOC Skill Suite for Claude Code and OpenAI Codex through the Open Agent and AI Security Community. Steve Wilson, Exabeam’s Chief AI and Product Officer, says the future SOC will be defined “by how effectively people and AI agents work together.” No performance figures were published.
Sources: SiliconANGLE (Exabeam’s Nova AI agent becomes a persistent investigator as LogRhythm gets AI updates)
4. A systemic market utility puts an investigation agent on its SIEM
Amazon (AWS press) · PR Newswire (Leidos) · Splunk · September 29, 2026 – October 2, 2026
The Options Clearing Corporation — the world’s largest equity derivatives clearing organisation, overseen by the SEC, CFTC and Federal Reserve as a Systemically Important Financial Market Utility — built a SOC Agent on Amazon Bedrock to automate alert investigation. The agent runs investigative loops over OCC’s SIEM data, mirroring an analyst: form a question, retrieve evidence, evaluate it, repeat. “The SOC Agent was designed to automate an investigative workflow while keeping OCC’s security experts firmly in control of the process and its outcomes,” said Ben Le, OCC’s Deputy Chief Security Officer. The release gives no metrics or rollout timeline.
Leidos made a similar launch for government SOCs. UpHold Effect Agentic SOC Automation runs agents around the clock to investigate alerts and assemble findings for human review, works alongside existing tools, lets each organisation set what the AI may investigate, recommend or execute on its own, and records every observation, conclusion and action. Leidos says it is FedRAMP-authorised, with a path toward DoD Impact Levels 4 and 5 with government sponsorship. “Cyber teams need to keep pace with threats without giving up control,” said Steve Hull, president of Leidos Digital.
Splunk’s Rod Soto describes the same design from the platform side: the analyst validates the evidence, understands the uncertainty and approves actions; agent-generated SPL keeps each recommendation inspectable; investigations feed back into detection engineering; and the SOC monitors its own agents for prompt injection, manipulated data, unsafe tool calls and compromised agent identities. All three are vendor-authored, so the useful question for your own pilot is what the audit trail shows when an analyst overrides the agent.
Sources: Amazon (AWS press) (OCC Strengthens Security Operations with an Agentic AI Investigation Solution Built on AWS) · PR Newswire (Leidos) (Leidos launches agentic AI platform to speed response to cyber threats) · Splunk (Trusted Agentic SOC: The AI in Security and the Security in AI)
5. Analysts mostly like AI, but worry about the bottom rung
Cybersecurity Dive · October 1, 2026
Swimlane, an agentic AI vendor, surveyed 500 security workers in the US and UK in August and September 2026. 62% said AI had helped them develop their skills, and 92% of that group reported higher job satisfaction. Even among the 24% who said AI limited their ability to build skills, 91% still reported higher satisfaction. 41% said AI cut the time they spend investigating known threat patterns, and about a third said it sped up remediation recommendations.
The worries are about the pipeline into the profession: 47% predicted that SOC analyst careers will become harder to obtain. Workload is shifting unevenly too — 52% of leaders said they now manage more security activities, against 36% of practitioners. Swimlane’s own summary is that “as AI assumes more investigative work, analysts are increasingly responsible for validating evidence, handling exceptions and making higher-impact decisions.” Read it as vendor-sponsored, and as a prompt to look at how your own team trains people who no longer start on routine triage.
Sources: Cybersecurity Dive (SOC staffers generally pleased with AI’s impact, but worries remain)
6. Agent swarms and post-breach testing draw the money
TechCrunch · Dark Reading · October 1–2, 2026
Armadin, founded by Mandiant founder Kevin Mandia, raised a $255.5M Series B at a $2.5B valuation, led by Andreessen Horowitz and Accel, with Bain Capital Ventures, Redpoint, 8VC, Ballistic Ventures, GV, In-Q-Tel, Kleiner Perkins and Menlo Ventures participating. That follows a $190M Series A in March and brings total funding past $445M. The product uses swarms of autonomous AI agents to test continuously, chaining vulnerabilities to simulate attacks on enterprise systems so weaknesses can be patched before attackers or rogue agents find them. No customers were named.
At the other end of the funding scale, RemoteThreat, founded in 2025 by CEO Chris Thompson and CTO Shawn Jones, raised $7M in pre-seed funding for AI-assisted red teaming that starts after the initial compromise, building custom tools for each engagement rather than using static payloads. “Pen testing is going to be a commodity market; it’s going to be done at scale,” Thompson told Dark Reading. For the SOC, both mean more validated attack paths arriving in the queue — which makes this week’s backlog data the relevant counterweight.
Sources: TechCrunch (Kevin Mandia’s new ’agent swarm’ security startup Armadin raises $255.5M at $2.5B valuation) · Dark Reading (RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail)
7. The bottleneck is deployment and ownership, not detection
Help Net Security · Dark Reading · September 30, 2026 – October 2, 2026
Cisco’s survey of 8,000 security professionals in 30 markets found only 8% of organisations reach its top tier of AI-era threat defence. Just 21% can deploy a new security control within six months of approval, against 52% of top performers, and 40% of teams spend more time collecting and matching data than pursuing threats. Internal friction makes up half of Cisco’s 100-point scoring model; one CSO in India described “confusion about who had the final authority to shut down the affected systems” during an incident.
Detectify’s analysis of 1,293 customers in the US, UK and the Nordics, using payload-based testing to confirm findings, found open critical and high vulnerabilities exposed for 90 days or more in 97% of cases in the Nordics, 92% in the UK and 86% in the US. The public sector resolved only 8.3% of critical and high findings within 90 days; consumer packaged goods led at 46.2%. Organisations with exposed AI tooling fixed critical flaws at less than half the rate of the wider base. “A security team may know exactly what needs to change, but the affected system could be owned by another department,” said Detectify CEO Rickard Carlsson.
Nishant Sharma’s Dark Reading column draws the conclusion: “Scanning capacity and remediation capacity are independent variables, and only one of them scales with a purchase order.” He names four ownership failures — no owner, no authority, no capacity, no consequence — and argues for tracking time to remediate by team, SLA compliance and the share of assets with a verified owner rather than raw finding counts. One programme he describes cut remediation time from 45 to 10 days and lifted SLA compliance from 30% to 95% mainly by fixing ownership.
Sources: Help Net Security (Most organizations need six months or longer to roll out new security controls) · Help Net Security (Most open critical and high flaws are over 90 days old) · Dark Reading (Vulnerability Backlogs Are an Ownership Problem)
8. BlueVoyant packages the move to Microsoft’s Integrated SOC
Channel Insider · October 2, 2026
BlueVoyant launched a Microsoft Defender XDR ISOC Deployment Service for Microsoft 365 E5 and E7 and Microsoft Defender Suite customers. It starts with a free ISOC Readiness Assessment of what is deployed and where it is fragmented, which does not need direct access to the environment: customers can export data snapshots instead. Deployment then covers Defender for Endpoint, Identity, Office 365 and Cloud Apps and Entra ID Protection, plus custom detection walkthroughs, workbooks, automation engineering and UEBA tuning.
The pitch is that operational debt should be cleared before agents are layered on top. “Agentic security turns yesterday’s technical debt into tomorrow’s decision debt,” said Micah Heaton, BlueVoyant’s Executive Director of Microsoft Product and Innovation Strategy. The service is available now, subject to customer eligibility, agreed scope and Microsoft’s phased rollout; pricing beyond the free assessment was not disclosed.
Sources: Channel Insider (BlueVoyant Launches Microsoft ISOC Deployment Service)
9. Make every threat hunt end in a decision
SC Media · September 30, 2026 – October 1, 2026
Two SC Media guides set a standard that answers the measurement problem in last week’s SANS survey. A hunt should end in one of four outcomes: adversary presence confirmed, a negative confirmation with adequate telemetry, a coverage gap identified, or a detection improved. The hypothesis must be written before any query and name the behaviour, scope, time window and expected evidence, so the hunt can be falsified. Before running anything, check that each required log source has recent data with the needed fields populated for the period hunted.
Execution tests four pivots — the primary signature, precursor signals, artifact trails and correlation pivots — rather than a single query. Outcomes then route to different owners: presence to incident response, negative confirmations and detection ideas to detection engineering, evidence gaps to exposure management or logging, and revised hypotheses back to the backlog. Measure the outcome mix rather than hunt volume; the guide suggests a mature programme lands around 40% negative confirmations, 30% coverage gaps, 20% detection improvements and 10% presence confirmations.
Sources: SC Media (What threat hunting actually controls) · SC Media (Hypothesis-driven threat hunting)
Calls to action
- Run a cost model before any SIEM migration pitch lands. Total your current SIEM cost per TB actually searched and stored, then compare it with Cribl’s roughly $18,000–$20,000 per TB per month infrastructure pricing and with a Microsoft ISOC estimate for your third-party data. Include the engineering time to translate and validate your existing Splunk or Sigma rules.
- Pick your ten highest-value detections as a migration test set. Whatever platform you evaluate, port those ten first and test them with known-good events. Assisted translation still needs validation, and this is the cheapest way to see what breaks.
- Write down agent permissions before a pilot starts. For each action an investigation agent could take — query, recommend, enrich, contain — decide whether it may run on its own, needs approval or is forbidden, and require an audit record of every recommendation and analyst override, as Leidos and OCC both describe.
- Add your AI tools to the log sources. Ingest activity feeds from ChatGPT, Gemini, GitHub Copilot or Claude Enterprise where your SIEM supports them, and start with alerts on prompts and tool calls that touch sensitive data or production systems.
- Name an owner for every internet-facing asset. Following the Dark Reading column, assign each asset to a person or standing team rather than a department, then report time to remediate and SLA compliance by owner instead of total open findings.
- Measure your own control deployment time. Take the last three security controls you approved and record how long each took to reach production. If it is over six months, find which approval or ownership step held it up before buying anything new.
- Make your next hunt falsifiable. Write the hypothesis with behaviour, scope, time window and expected evidence; check each required log source for recent, populated data; and record which of the four outcomes it ended in.
- Deploy a honey account this week. Following CISA’s decoy guidance, create a decoy Active Directory account with a 60-character random password, block it from authenticating, keep it out of routine deprovisioning, and alert on any attempt to use it with the EDR and IAM tooling you already own.
- Hunt for forged SAML sessions and rogue app registrations. Correlate service-provider sign-ins with ADFS issuance events (Event 1200) and alert on reads of the DKM container (Event 4662). For OAuth backdoors, block the application registration itself, not just its tokens, while isolating the affected host.
- Check your MDR contract against five questions. Which telemetry sources are monitored and which are not; which containment actions the provider may take without approval; how each SLA clock is defined; who owns connector and coverage health; and whether containment preserves forensic evidence.
|