Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time

* Cisco was the Official Security Cloud Provider at Black Hat USA.
* Cisco is a long-standing partner of the Black Hat NOC and SOC.
* In 2026, the team worked with Black Hat NOC leaders and partners: Palo Alto Networks, Arista, Corelight, Jamf, and Lumen.
* The first mission of the NOC/SOC is to keep the conference network operating safely and reliably.
* The Cisco and Splunk team focused on live NOC/SOC visibility, Splunk Enterprise Security detection engineering, threat hunting, malware analysis, AI protection, and Agentic SOC development.
* Telemetry ingested included logs from DHCP, DNS (from Cisco Secure Access, Jamf), Splunk Attack Analyzer, Cisco Secure Malware Analytics, Arista network data, Corelight, Palo Alto Networks firewall data, Cisco Secure Firewall, Cisco Secure Network Analytics, ThousandEyes, and Duo.
* Findings were investigated in Splunk Security with threat intelligence from Cisco Talos.
* Splunk Enterprise Security was used to build and improve detections based on NOC/SOC observations.
* Agentic SOC development focused on Cloud Control AI Studio and Agent Builder testing for event 2026.
* Live dashboards were presented at the Business Hall showing operational data from the NOC/SOC.

The narrative centers on transforming a high-noise, collaborative proving ground into a mechanism for operationalizing security practices that carry forward beyond the event itself. The core pattern involves leveraging an inherently messy, complex environment—the Black Hat setup—as the ideal laboratory for advanced security methodology development. This dynamic shifts the focus from static defense to dynamic learning and systemic improvement via Agentic workflows. The system is built on a hierarchy where foundational infrastructure stability (Cisco's role) enables subsequent innovation in detection engineering (Splunk ES) and next-generation operational models (Agentic SOC). The emphasis on building reusable content from event telemetry demonstrates an attempt to counter the ephemeral nature of conference work by embedding lessons into future systems. A critical implication is whether this highly specific, collaborative integration between vendors and a specialized NOC can be scaled effectively outside of curated environments or if it remains contingent on the unique social structure of the event setting. The pattern suggests that operationalizing security—moving from detection to automated action—requires a context rich enough to validate those actions against real-world noise, which is what the Black Hat environment uniquely provides.
Bridge Questions: What are the quantifiable metrics used to measure the efficacy of the Agentic workflows developed at Black Hat versus standard enterprise SOC procedures? How can the operational velocity gained in this specialized setting be systematically translated into long-term, non-event-specific security architecture standards? What is the dependency on the specific vendor ecosystem present at the event for sustaining these integrated capabilities after the immediate pressure of the conference subsides?