How is AI Changing Cybersecurity?

Summary

At .conf 2026, David Bombal follows a theme running through several demonstrations and interviews: AI-powered cybersecurity depends on good data, clear oversight, and humans who can verify what systems tell them.

Demonstrations and technologies

• Telemetry-driven simulations: A racing simulator sends lap data to a cloud collector, which converts UDP telemetry into JSON and loads it into Splunk dashboards. Comparing laps makes it possible to see changes in speed and braking. A flight-simulator demo similarly sends game metrics through Splunk’s HTTP Event Collector to Dashboard Studio, where player scores and live metrics are displayed.
• Games that expose application problems: In a separate demo, gameplay affects a real e-commerce application running on Kubernetes. In Trace Invaders, game enemies represent Kubernetes pods; the open-source Chaos Mesh project is used to introduce disruptions such as CPU load and network or disk latency. Dashboards show how those changes affect the system.
• “Born observed” and AI infrastructure: The idea is to make observability available when an environment is set up, with its components connected automatically, then let users specify what they want monitored. The discussion highlights monitoring resource use, memory, networking, and other infrastructure conditions, including those relevant to AI workloads.
• Cisco Data Fabric: Cisco describes an architecture for federating and accessing machine data, correlating information across domains such as applications, networks, infrastructure, and security, and preparing that data for AI agents. The approach is presented as open to third-party data, including data from other vendors.
• Guided security investigations: A bot-hunting demo helps users examine evidence and work through investigation choices, rather than requiring them to begin with deep Splunk or security expertise. At LSU, students gain experience investigating real-world threats in a SOC, working alongside professionals and using AI with humans still involved.
• AI in SOC operations: AI agents could help analysts handle the speed and volume of alerts by assisting with detection, investigation, and response. The discussion also stresses correlating signals from users and endpoints, and using analyst feedback to improve an agent’s judgments.
• Prompt-injection workflow demo: Bruce Snell shows a simulated incident in which Cisco security devices identify suspicious activity and Splunk analyzes it as a prompt-injection attack. A unified view and real-time notifications are intended to help investigators trace and respond to incidents without switching among multiple consoles. The video explicitly describes this as a workflow demonstration, not a real conference incident.

Key takeaways

• AI needs more than a model: it needs relevant organizational data and workflow context. Teams should check both the inputs and the results, and ensure the system uses appropriate sources and transformations.
• The cost of deploying agents at scale also matters. Organizations need to weigh the value produced against token and operating costs.
• The preferred approach is purposeful autonomy: automate routine work, but keep people involved in consequential decisions. AI should support judgment, not replace it.
• Security professionals should keep investigating, question AI-generated answers, and check the evidence. Critical thinking and understanding the underlying systems remain essential.

Reviews, guides, or tutorials

The video is an event report featuring product and workflow demonstrations, rather than a step-by-step tutorial or product review.

Main speakers and sources

David Bombal is the interviewer and narrator. Demonstrations and perspectives are attributed in the subtitles to Robert (racing simulator), Paul (flight simulator), Leila (AI infrastructure), Kamal Hathi (AI and SOC autonomy), Hanlin Fang (Cisco Data Fabric), Tom Smit (bot hunting), Craig Woolley (LSU SOC), Jessica Oppenheimer (SOC operations), and Bruce Snell (simulated prompt-injection workflow).