Fall Cyber Solutions Fest 2026: SOC Track

Wed, Nov 18, 2026
10:00AM - 5:05PM EST
English
Mark Orlando
Solutions Forum

Thank You To Our Sponsors

The SANS Fall Cyber Solutions Fest 2026 SOC Track brings together frontline defenders, analysts, engineers, and SOC leaders to dissect the evolving threat landscape and the technologies reshaping modern security operations. With adversaries advancing faster than ever, this track delivers deep technical sessions focused on detection engineering, advanced analytics, automation, AI-enhanced triage, and next-generation SOC architectures designed for hybrid and cloud-native environments. Attendees will learn practical methods to reduce alert fatigue, enhance threat visibility, and accelerate response—rooted in real-world case studies from industry experts.

Through hands-on demonstrations, expert-driven briefings, and collaborative discussions, participants will explore tools, frameworks, and operational best practices that drive measurable SOC maturity. Whether your team is improving existing workflows or architecting a future-state SOC, this track equips security professionals with actionable strategies to operationalize intelligence, leverage automation responsibly, and build a resilient, adaptive detection and response capability. Join us to strengthen your SOC’s effectiveness and prepare for the challenges of tomorrow’s cyber landscape.

Who Should Attend:

SOC analysts, detection engineers, incident responders, and threat hunters seeking practical, real-world techniques to elevate their operational capabilities.
SOC managers, CISOs, and security leaders focused on maturing their SOC programs, optimizing workflows, and integrating automation and AI.
Organizations evaluating next-generation SOC tools, architectures, and strategies to strengthen resilience and accelerate threat detection and response.

Get Connected —> Join us on Slack!

Don't miss these Fall Cyber Fest tracks to attend live or view on-demand later:

Schedule

Showing 16 of 16

Filter by:

Select day:

Opening Remarks

10:00AM - 10:15AM EST

Virtual

Presented by

Mark Orlando

Field CTA at Push Security

Your SOC Is Only as Smart as What Surrounds It

A SOC's outcomes mirror the program around it. When asset context, identity data, exposure and business priority live with other teams, analysts work without the full picture and every handoff slows them down. So how can the SOC work smarter and faster?

The answer is automation that extends across the whole security program, both upstream and downstream of the SOC. In this session, we’ll examine where agents and workflows can take on operator roles and keep context flowing between teams. The result is a SOC that makes better decisions and moves faster, because it has the context of the broader program at the speed of AI.

Attendees will leave with a way to map their program's dependencies, a framework for deciding what to automate and how, including when to use agents and when to use determinism, and a realistic view of what agents can do today and what still needs a human.

*Sponsored by BlinkOps

10:15AM - 10:55AM EST

Virtual

Presented by

Andrew Dayton

Principal Security Strategist at BlinkOps

Joshua Weinick

AI Automation Engineer at BlinkOps

Build Your Own Custom SOC Agents

While many native security operations agents dramatically improve security workflows, organizations sometimes need more customization.

This session will demonstrate how to build and orchestrate custom SOC agents using Google Security Operations MCP servers and the Agent Development Kit (ADK). You will learn how to structure agent instructions, enforce security guardrails, and reason over security logs, incidents, and threat intelligence.

*Sponsored by Google

10:55AM - 11:35AM EST

Virtual

Presented by

Tarah Lewis

Global Security Architect at Google Cloud Security

The Layer Beneath the Agents: Context, Memory, and Learning in the AI SOC

Every vendor now claims an "AI SOC," and AI-accelerated threats keep raising the stakes. Yet most solutions stop at triage, which is where the real work begins. A true AI SOC runs the complete threat lifecycle end to end, and the real differentiator is the layer beneath the agents: the context that grounds every decision, the memory that gives it precedent, and the learning that teaches it your team's judgment.

See how that comes together across the Torq AI SOC Platform, where Torq Auto Triage cuts EDR noise up to 97% and works with Case Management, Socrates, and Hyperautomation to slash MTTR 94% on average. The Context Graph and Recall give the SOC lasting memory, while Reflex learns your team's judgment to become uniquely yours, with a 20-point accuracy lift over the nearest alternative.

Join Torq's Rick Bosworth as we discuss how a true AI SOC works and what security leaders should consider before betting on one. Walk away with: What defines a true end-to-end AI SOC, and why context, not knowledge, is the line that matters How context, memory, and learning combine into an AI SOC that compounds in value the longer it runs A CISO's playbook for the shift to agentic SecOps: where to start with autonomy, how the org chart changes, and how to build trust as you scale

*Sponsored by Torq

11:35AM - 12:05PM EST

Virtual

Presented by

Rick Bosworth

Head of Product Marketing at Torq

Break

12:05PM - 12:15PM EST

Virtual

Stop Frontier AI Threats With an Agentic SOC

Join Torq's Rick Bosworth as we discuss how a true AI SOC works and what security leaders should consider before betting on one. Walk away with:

What defines a true end-to-end AI SOC, and why context, not knowledge, is the line that matters
How context, memory, and learning combine into an AI SOC that compounds in value the longer it runs
A CISO's playbook for the shift to agentic SecOps: where to start with autonomy, how the org chart changes, and how to build trust as you scale.

*Sponsored by Palo Alto Networks

12:15PM - 12:45PM EST

Virtual

Presented by

Kasey Cross

Director, Product Marketing, Cortex XSIAM at Palo Alto Networks

AI in the SOC

AI is transforming the SOC by helping security teams analyze threats faster, automate investigations, and reduce the burden of repetitive tasks. This session explores how AI can augment analysts, accelerate malware and phishing analysis, and enable more efficient, scalable threat detection and response.

*Sponsored by VMRay

12:45PM - 01:15PM EST

Virtual

Presented by

Andrey Voitenko

Senior Product Manager at VMRay

Every Decision Yours: Staying in Control of an Agentic SOC

A defender can still outthink an attacker, but they can't out-work one that runs on software. Closing that gap means using AI to automate defense, but before teams can trust AI with their most critical security problems, they need to know it will work when they need it to. AI resilience means having models that are still available, even if a provider, service, or API isn't.

This session introduces AlertZero, Elastic Security’s agentic layer, and the three key controls teams need for AI resilience:

Model and provider choice, so a provider outage or a guardrail change mid-incident doesn’t take the SOC down with it
Transparency in reasoning, so model decisions are auditable and recommendations are backed by evidence
Configurable guardrails and levels of automation that allow teams to control levels of approval and autonomy based on risk tolerance and agent efficacy

When used effectively, AI doesn't replace analysts, it accelerates their triage, investigation, and threat hunting. The human isn’t removed from the loop, they’re moved to the top of it, making the final call on the SOC's most important decisions.

Learn the questions to ask any AI security vendor, including Elastic, before trusting agents with critical security operations decisions.

*Sponsored by Elastic Security

01:15PM - 01:45PM EST

Virtual

Presented by

Paul Ewing

Senior Product Manager at Elastic Security

Break

01:45PM - 02:00PM EST

Virtual

The SOC at the Center: How CIS Services Work Together to Defend Your Organization

The CIS Security Operations Center (SOC) is the unseen key to its Services. In this presentation, we'll look at how the SOC is the foundation of what we deliver and threads cross-agency intelligence together to detect threats sooner, respond faster, and protect organizations of every size and sector.

We'll walk through how the SOC powers and draws on CIS Managed Detection and Response (MDR), Managed Extended Detection and Response (MXDR), Cyber Threat Intelligence, the Cyber Incident Response Team (CIRT), and Red Team services.

You'll see how detection, intelligence, and response come together, and how what we learn in one area makes every other service stronger. You'll leave with a clearer picture of how these services fit together, what happens behind the scenes when an alert fires, and how to get the most from your CIS relationship.

*Sponsored by Center for Internet Security

02:00PM - 02:30PM EST

Virtual

Presented by

Lee Noriega

Executive Director, Emerging Products & Solutions at Center for Internet Security

Kevin Garnier

Cybersecurity Solutions Engineer at Center for Internet Security

Defending Against the AI-Powered Adversary: A Practitioner's Playbook for the Agentic SOC

AI didn't invent cyberattacks, but it has significantly reduced the cost, skill, and time they used to take. The gap between a patch shipping and a working exploit has shrunk from weeks to under an hour. Attackers are also running model-directed malware like LameHug, which generates fresh commands on the victim's machine every run. No two runs look alike, so signatures don't catch it.

You can't prevent your way out of this. You have to be able to see it. To survive the post-Mythos world, organizations need an Agentic SOC. For the practitioner doing the work every day, here's what that means in practice.

This session is a 101-level playbook for starting your Agentic SOC journey. We'll cover the pitfalls we see teams hit most often and the quick wins you can take back to your team right away. We'll also make the case that network visibility should be your ground truth: watching the wire shows you every conversation without installing an agent. Then we'll drop the slides for a live demo of token-efficient reasoning and behavioral detection hunting threats at machine speed.

*Sponsored by Extrahop

02:30PM - 03:00PM EST

Virtual

Presented by

Paul Giorgi

VP, Technical Marketing Engineer at ExtraHop

Session Details Coming Soon!

*Sponsored by Fortinet

03:00PM - 03:30PM EST

Virtual

Break

03:30PM - 03:45PM EST

Virtual

Session Details Coming Soon!

*Sponsored by Sentinel One

03:45PM - 04:15PM EST

Virtual

Panel Discussion

*Sponsored by BlinkOps and Google

04:15PM - 05:00PM EST

Virtual

Moderated by

Mark Orlando

Field CTA at Push Security

Presented by

Andrew Dayton

Principal Security Strategist at BlinkOps

Tarah Lewis

Global Security Architect at Google Cloud Security

Closing Remarks

05:00PM - 05:05PM EST

Virtual

Presented by

Mark Orlando

Field CTA at Push Security

Meet Your Speaker

Mark Orlando

Field CTA at Push Security

Mark Orlando, SANS Instructor and LDR551 co-author, brings decades of SOC leadership experience to help practitioners build, scale, and operate effective security operations programs.

SEC536: Adversarial AI - Penetration Testing AI Systems

Fall Cyber Solutions Fest 2026: SOC Track

Share

Thank You To Our Sponsors

Who Should Attend: