Cognitive Agents Delivering Wisdom at Scale

The talk starts from the strain on security operations centers: analysts lose much of their day triaging alerts that turn out to be nothing, while alert volumes keep climbing and attackers increasingly use AI. The speaker argues the goal is collaboration between humans and agents, not replacement, and traces detection from isolated alerts to correlated incidents. The next step described is reasoning about why an event happened and how much it matters.

The proposed design is a set of LLM-based agents. An orchestrator runs SOP-style playbooks and holds approval guardrails. An investigator gathers context such as asset ownership and threat intelligence and builds an end-to-end story; one demo assembled a business email compromise from four separate alerts. A prioritizer rates whether that story is a true positive, with a confidence score and recommended actions. A responder can contain threats within permitted limits, a hunter searches for similar activity elsewhere, and a rule-writing agent turns lessons from an incident into new detections. The demos used scrubbed client data in a test environment.

The expected outcomes are less noise, faster containment, and lower analyst burnout. Adoption advice is to start small, target one pain point with a single agent, measure results and iterate. In the questions, the speaker acknowledged that prompt injection from untrusted data is a concern not yet addressed, and that enforcing SOPs from varied sources relies on code-level guardrails. Smaller specialized models were suggested as a way to cut cost.