SANSFIRE 2025: Keynote - Internet Storm Center Keynote: Squirrels - Taming AI Distractions for Smarter Security Operations

For security operations, distractions can be dangerous. A “denial of service” against a defender often leads to missed alerts and compromise. The tool must never be the focus but the results the tool provides should determine the value of the tool. AI tools are currently in the “new and cool” phase of the hype cycle. There is no week without a major new AI development. As a result, defenders tend to spend a lot of time trialing new tools and little time properly integrating them into security operations. During this presentation, we interview several defenders to learn what turned out to be just a distraction, or what tools turned out to be a game changer for operations once properly integrated.