The gap between AI-accelerated offense and human-paced defense is no longer theoretical. Adversaries are using agentic tooling to automate reconnaissance, weaponize new vulnerabilities faster, and produce convincing lures at scale. That shrinks the time between first signal and real impact. Threat intelligence delivered as a weekly report can't keep up with that tempo.
Defenders are responding with agentic SOCs and autonomous detection and response, but those systems are only as good as the intelligence feeding them. That raises a new set of questions for CTI teams. How do you make intelligence machine-consumable and trustworthy enough for an AI agent to act on? How do you defend your pipelines against poisoned, stale, or manipulated intelligence? How do you keep humans accountable for decisions made at machine speed? And how do you prove your CTI program is producing value and changing outcomes rather than just producing output?
Join Ismael Valenzuela, SANS Senior Instructor and author of SEC530, as he chairs the 2027 CTI Solutions Track. True to his Think Red, Act Blue philosophy, the track brings together solution providers and practitioners over two days to show how intelligence is being put to work inside agentic workflows. Sessions will cover intelligence-driven detection engineering, confidence and provenance scoring, integration with exposure management and incident response, and metrics that tie CTI to measurable risk reduction.
Through vendor showcases, live demos, and moderated panels, attendees will leave with practical approaches for building CTI that operates at machine speed while staying explainable, verifiable, and grounded in how adversaries actually operate.
