AI & Agentic AI for Modern Threat Detection

About the Session Most AI-in-security conversations collapse three very different technologies into one word. That confusion is why programs stall.

This session separates them. Machine learning does anomaly detection — UEBA peer-group baselining, isolation forests, beaconing and DGA detection, process-tree anomalies — finding the signal in 30,000+ weekly alerts. Generative AI does the reasoning layer — grounded alert summarisation, asset and identity enrichment, severity scoring, security posture quantification — converting alerts into decision-ready incidents. Agentic AI does the closing loop — autonomous investigation, cross-tool orchestration, containment playbooks, proactive threat hunting — all under human-in-the-loop gates.

Grounded in patterns from 1000+ forensic investigations and live SOC operations, the session walks the evolution from rule-based detection through ML/UEBA to the GenAI + Agentic layer, showing measured impact on MTTD and MTTR at each step. Attendees leave with a vendor-neutral reference architecture, the guardrail pattern that makes LLM output survive an audit, and a clear-eyed view of where each of the three fails.