Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Sumo Logic's SOC Analyst Agent automatically triages every insight within the SIEM, replacing the manual work that used to fall to a tier-one analyst. Using Sumo Logic's own SOC as customer zero, we found that 100% of tier-one alerts are triaged end-to-end by the agent, resulting in a 89% reduction in median time to triage, from 28 minutes to 3 minutes. In this demo, you’ll see.

Somesh Agarwal, Senior Director of Security Operations at o9 Solutions, explains how the AI planning platform behind many of the world's largest supply chains consolidated security operations and observability on Elastic Security to gain unlimited threat-hunting retention, accelerate detection engineering, and simplify multicloud security operations.

Mobot is Sumo Logic's conversational interface designed to streamline investigations for SOC analysts and observability users. Ask a question in plain English and get a full SOC analyst-style investigation without writing a query. Inside an Insight, Mobot pulls context like the C2IP, ransomware hash, host, and exfiltration data automatically. A six-word question, "anyone else hit by the campaign?", triggers a full investigation across every mailbox and endpoint tied to that attack, with a link to the raw query behind every answer.

On this episode of Masters of Data, we take you inside the Dojo AI demo we're bringing to the show floor at Black Hat. We walk through the SOC Analyst Agent, Mobot, and MCP back to back. SOC Analyst Agent triages every tier one alert down to the one that actually matters, and Mobot picks up from there, running the investigation in plain English to track down other phishing victims and lateral movement. We also show how MCP pulls that same insight into Claude or Slack. SOC leads tired of alert fatigue and analyst burnout will want the numbers here: 100% of tier one alerts triaged automatically, and 25 hours a week back per person.

Turn compliance complexity into your operational advantage. One system. Full historical context. Predictable cost. Sophos Next-Gen SIEM: Learn more at sophos.com/ng-siem.

With Next-Gen SIEM fully integrated with Sophos XDR, the same system that powers real-time defense can retain the data you need for up to 10 years at a predictable price based on users and servers, supporting your compliance efforts and enriching investigations with full historical context.

What if your next breach came down to a token budget? In this episode, Steve Moore is joined by Lou Rabon, Founder and CEO of Cyber Defense Group, for a conversation on the modern CISO's world—from how to interview for the seat, to why AI agents are the next insider threat, to research that reframes breach cost as a token calculation.

Subscribe for more product demos and cybersecurity insights!

On this episode of Masters of Data, we revisit the predictions Adam White, Zoe Hawkins, and David Girvin made at the end of last year, checking our own scorecard halfway through 2026. The hits: agents running amok and deleting databases, MCP becoming the backbone for tracking what agents actually do, growing security gaps around personal data, and a collective rejection of low-quality AI content. The misses: we underestimated how fast companies would cut staff for AI, then quietly start rehiring once the agents couldn't cover the work, and we're still arguing about whether token burn is a cost problem or a coming attack vector.

Graylog is for lean security and IT teams who need practical detections, clear context, and predictable outcomes without the overhead of traditional SIEMs. See how Graylog helps lean teams move from noise to clarity, and why so many organizations are rethinking what effective detection really looks like.