AI-driven SOC transformation depends on more than adding artificial intelligence to an existing SIEM. It requires high-quality security data, consistent analysis, intelligent automation and human oversight.
In this Black Hat USA 2026 interview, Kevin Kin, Vice President of Channel and Commercial Technical Solutions at Palo Alto Networks, and Edward Bailey, Field CISO at Cribl, explain how organizations can modernize security operations while managing rapidly growing data volumes, legacy architectures and constrained SOC resources.
The discussion explores how an AI-driven security operations center can accelerate threat detection, investigation, triage and remediation. The speakers also address why organizations must understand which security data delivers value, which data is required for detection or compliance and which data does not need to remain in expensive analytics platforms.
Key topics include:
• How AI is changing cybersecurity risks and security operations
• Why AI agents increase identity and security data requirements
• What an AI-driven SOC looks like in practice
• How AI can improve analyst productivity and consistency
• Why human oversight remains essential in security operations
• How to improve security data quality for AI models
• How to reduce risk during a legacy SIEM migration
• Why legacy and new SIEM environments may need to run in parallel
• How Palo Alto Networks and Cribl support SOC transformation
• Why security teams need stronger data management skills
The speakers recommend beginning SOC modernization with a clear understanding of the organization’s risk profile, data requirements and existing security telemetry. Organizations can then align their technology, people and processes with the data needed to produce scalable, repeatable and reliable security outcomes.
Learn more about how Palo Alto Networks is helping organizations modernize security operations and accelerate AI-driven outcomes.
Chapters:
00:00 Introduction from Black Hat USA 2026
00:24 How the cybersecurity landscape is changing
01:43 Balancing AI enablement with security risk
03:18 The growing security data problem
05:11 How data growth affects the modern SOC
06:06 What an AI-driven SOC actually looks like
07:27 Data architecture for AI-driven security operations
09:17 Improving SOC analyst consistency with AI
10:05 Palo Alto Networks and Cribl partnership
11:23 Reducing risk during SIEM migration
12:12 The human side of SOC transformation
13:01 Advice for security leaders
14:09 Closing remarks
#AIDrivenSOC #SecurityOperations #Cybersecurity
