Security data tends to sit across SIEMs, data lakes, cloud platforms, and a long tail of tools, with no consistent way to operate across any of it. Bolting an AI assistant onto one more console does nothing about the architecture underneath.

Recorded at Black Hat USA 2026, this session defines Agentic SecOps as an operating model rather than a product label, and shows how governed agents carry repeatable work across data onboarding, federated search, detection engineering, and investigation while analysts keep approval authority over the decisions that carry real risk.

It walks through three adoption paths that all leave the existing stack in place, augmenting an existing SIEM, running a hybrid of SIEM and security data lake, or operating directly on cloud-scale data platforms, along with the architecture patterns, approval controls, and portable detection content each one depends on. The closing stretch covers the implementation pitfalls worth knowing in advance, and the measures that show whether the automation is improving anything.

What you will learn

• What Agentic SecOps is, and how it differs from legacy SIEM workflows and bolt-on AI tools
• How to operate across SIEMs, data lakes, cloud platforms, and security repositories
• Which workflows suit governed agentic automation
• Where human approval and oversight should stay in the process
• How to evaluate progress through detection coverage, onboarding speed, triage efficiency, analyst effort, and infrastructure cost

Presenters
Rohith Kondeti, Senior Security Field Engineer, Anvilogic
Michael Monte, VP of Customer Success, Anvilogic