AI SOC and Securing your Environment

The talk opens by asking where AI fits into a security operations center, taking a vendor-neutral view of agentic deployments, managed AI SOC services, and how teams can adapt to a changed threat landscape. The speaker argues AI should enable analysts rather than replace them. One example is a PowerShell script beside an endpoint detection tool that collects logs only when a detection fires and forwards them to a SIEM, avoiding constant ingestion costs.

The middle turns to misuse of the same automation. An attacker who learns which events trigger AI-driven workflows can flood them with noise to inflate token costs or overwhelm a small team. An insider scenario follows, in which a locally run model studies an environment and helps plan an intrusion that existing tools may miss. The talk also weighs outside frontier-model APIs against self-hosted models, notes model poisoning risks, and compares per-token and per-agent vendor pricing.

For practitioners, the recommendations treat AI usage as telemetry. Teams should monitor token consumption, alert on spikes in AI investigation volume, document manual fallbacks for when AI workflows degrade, baseline query behavior by identity role, and restrict what agents can reach through MCP servers. Vetting AI tooling as part of the supply chain is also urged, though the speaker concedes there is no mature verification method yet. Audience questions covered the logging script and local model costs.