CrowdStrike, Cisco and Palo Alto Networks all shipped agentic SOC tools at RSAC 2026 — the agent behavioral baseline gap survived all three

CrowdStrike CEO George Kurtz highlighted in his RSA Convention 2026 keynote that the quickest recorded adversary breakout time has dropped to 27 seconds. The typical is now 29 minutes, down from 48 minutes in 2024. That’s how a lot time defenders have earlier than a menace spreads. Now CrowdStrike sensors detect greater than 1,800 distinct AI purposes working on enterprise endpoints, representing almost 160 million distinctive utility situations. Each one generates detection occasions, identification occasions, and knowledge entry logs flowing into SIEM techniques architected for human-speed workflows.

Cisco discovered that 85% of surveyed enterprise prospects have AI agent pilots underway. Solely 5% moved brokers into manufacturing, in accordance with Cisco President and Chief Product Officer Jeetu Patel in his RSAC weblog submit. That 80-point hole exists as a result of safety groups can’t reply the fundamental questions brokers drive. Which brokers are working, what are they licensed to do, and who’s accountable when one goes unsuitable.

“The primary menace is safety complexity. However we’re working in direction of that route in AI as effectively,” Etay Maor, VP of Menace Intelligence at Cato Networks, informed VentureBeat at RSAC 2026. Maor has attended the convention for 16 consecutive years. “We’re going with a number of level options for AI. And now you’re creating the subsequent wave of safety complexity.”

Brokers look an identical to people in your logs

In most default logging configurations, agent-initiated exercise seems an identical to human-initiated exercise in safety logs. “It seems indistinguishable if an agent runs Louis’s net browser versus if Louis runs his browser,” Elia Zaitsev, CTO of CrowdStrike, informed VentureBeat in an unique interview at RSAC 2026. Distinguishing the 2 requires strolling the method tree. “I can truly stroll up that course of tree and say, this Chrome course of was launched by Louis from the desktop. This Chrome course of was launched from Louis’s cloud Cowork or ChatGPT utility. Thus, it’s agentically managed.”

With out that depth of endpoint visibility, a compromised agent executing a sanctioned API name with legitimate credentials fires zero alerts. The exploit floor is already being examined. Throughout his keynote, Kurtz described ClawHavoc, the primary main provide chain assault on an AI agent ecosystem, focusing on ClawHub, OpenClaw’s public expertise registry. Koi Safety’s February audit discovered 341 malicious expertise out of two,857; a follow-up evaluation by Antiy CERT recognized 1,184 compromised packages traditionally throughout the platform. Kurtz famous ClawHub now hosts 13,000 expertise in its registry. The contaminated expertise contained backdoors, reverse shells, and credential harvesters; Kurtz stated in his keynote that some erased their very own reminiscence after set up and will stay latent earlier than activating. “The frontier AI creators won’t safe itself,” Kurtz stated. “The frontier labs are following the identical playbook. They’re constructing it. They are not securing it.”

Two agentic SOC architectures, one shared blind spot

Strategy A: AI brokers contained in the SIEM. Cisco and Splunk introduced six specialised AI brokers for Splunk Enterprise Safety: Detection Builder, Triage, Guided Response, Normal Working Procedures (SOP), Malware Menace Reversing, and Automation Builder. Malware Menace Reversing is at present accessible in Splunk Assault Analyzer and Detection Studio is usually accessible as a unified workspace; the remaining 5 brokers are in alpha or prerelease by way of June 2026. Publicity Analytics and Federated Search comply with the identical timeline. Upstream of the SOC, Cisco’s DefenseClaw framework scans OpenClaw expertise and MCP servers earlier than deployment, whereas new Duo IAM capabilities prolong zero belief to brokers with verified identities and time-bound permissions.

“The most important obstacle to scaled adoption in enterprises for business-critical duties is establishing a enough quantity of belief,” Patel informed VentureBeat. “Delegating and trusted delegating, the distinction between these two, one results in chapter. The opposite results in market dominance.”

Strategy B: Upstream pipeline detection. CrowdStrike pushed analytics into the info ingestion pipeline itself, integrating its Onum acquisition natively into Falcon’s ingestion system for real-time analytics, detection, and enrichment earlier than occasions attain the analyst’s queue. Falcon Subsequent-Gen SIEM now ingests Microsoft Defender for Endpoint telemetry natively, so Defender outlets don’t want extra sensors. CrowdStrike additionally launched federated search throughout third-party knowledge shops and a Question Translation Agent that converts legacy Splunk queries to speed up SIEM migration.

Falcon Knowledge Safety for the Agentic Enterprise applies cross-domain knowledge loss prevention to knowledge brokers’ entry at runtime. CrowdStrike’s adversary-informed cloud danger prioritization connects agent exercise in cloud workloads to the identical detection pipeline. Agentic MDR by way of Falcon Full provides machine-speed managed detection for groups that can’t construct the aptitude internally.

“The agentic SOC is all about, how can we sustain?” Zaitsev stated. “There’s virtually no conceivable method they will do it in the event that they don’t have their very own agentic help.”

CrowdStrike opened its platform to exterior AI suppliers by way of Charlotte AI AgentWorks, introduced at RSAC 2026, letting prospects construct customized safety brokers on Falcon utilizing frontier AI fashions. Launch companions embody Accenture, Anthropic, AWS, Deloitte, Kroll, NVIDIA, OpenAI, Salesforce, and Telefónica Tech. IBM validated purchaser demand by way of a collaboration integrating Charlotte AI with its Autonomous Menace Operations Machine for coordinated, machine-speed investigation and containment.

The ecosystem contenders. Palo Alto Networks, in an unique pre-RSAC briefing with VentureBeat, outlined Prisma AIRS 3.0, extending its AI safety platform to brokers with artifact scanning, agent crimson teaming, and a runtime that catches reminiscence poisoning and extreme permissions. The corporate launched an agentic identification supplier for agent discovery and credential validation. As soon as Palo Alto Networks closes its proposed acquisition of Koi, the corporate provides agentic endpoint safety. Cortex delivers agentic safety orchestration throughout its buyer base.

Intel introduced that CrowdStrike’s Falcon platform is being optimized for Intel-powered AI PCs, leveraging neural processing models and silicon-level telemetry to detect agent habits on the gadget. Kurtz framed AIDR, AI Detection and Response, as the subsequent class past EDR, monitoring agent-speed exercise throughout endpoints, SaaS, cloud, and AI pipelines. He stated that “people are going to have 90 brokers that work for them on common” as adoption scales however didn’t specify a timeline.

The hole no vendor closed

The matrix makes one factor seen that the keynotes didn’t. No vendor shipped an agent behavioral baseline. Each approaches automate triage and speed up detection. Based mostly on VentureBeat’s evaluate of introduced capabilities, neither defines what regular agent habits seems like in a given enterprise surroundings.

Groups working Microsoft Sentinel and Copilot for Safety signify a 3rd structure not formally introduced as a competing method at RSAC this week, however CISOs in Microsoft-heavy environments want to check whether or not Sentinel’s native agent telemetry ingestion and Copilot’s automated triage shut the identical gaps recognized above.

Maor cautioned that the seller response recycles a sample he has tracked for 16 years. “I hope we don’t should undergo this complete cycle,” he informed VentureBeat. “I hope we realized from the previous. It doesn’t actually seem like it.”

Zaitsev’s recommendation was blunt. “You already know what to do. You’ve identified what to do for 5, ten, fifteen years. It’s time to lastly go do it.”

5 issues to do Monday morning

These steps apply no matter your SOC platform. None requires ripping and changing present instruments. Begin with visibility, then layer in controls as agent quantity grows.

1. Stock each agent in your endpoints. CrowdStrike detects 1,800 AI purposes throughout enterprise units. Cisco’s Duo Id Intelligence discovers agentic identities. Palo Alto Networks’ agentic IDP catalogs brokers and maps them to human house owners. Should you run a special platform, begin with an EDR question for identified agent directories and binaries. You can not set coverage for brokers you have no idea exist.

2. Decide whether or not your SOC stack can differentiate agent from human exercise. CrowdStrike’s Falcon sensor and AIDR do that by way of course of tree lineage. Palo Alto Networks’ agent runtime catches reminiscence poisoning at execution. In case your instruments can’t make this distinction, your triage guidelines are making use of the unsuitable behavioral fashions.

3. Match the architectural method to your present SIEM. Splunk outlets acquire agent capabilities by way of Strategy A. Groups evaluating migration get pipeline detection with Splunk question translation and native Defender ingestion by way of Strategy B. Palo Alto Networks’ Cortex delivers a 3rd choice. Groups on Microsoft Sentinel, Google Chronicle, Elastic, or different platforms ought to consider whether or not their SIEM can ingest agent-specific telemetry at this quantity.

4. Construct an agent behavioral baseline earlier than your subsequent board assembly. No vendor ships one. Outline what your brokers are licensed to do: which APIs, which knowledge shops, which actions, at which instances. Create detection guidelines for something exterior that scope.

5. Strain-test your agent provide chain. Cisco’s DefenseClaw and Explorer Version scan and red-team brokers earlier than deployment. CrowdStrike’s runtime detection catches compromised brokers post-deployment. Each layers are vital. Kurtz stated in his keynote that ClawHavoc compromised over a thousand ClawHub expertise with malware that erased its personal reminiscence after set up. In case your playbook doesn’t account for a certified agent executing unauthorized actions at machine velocity, rewrite it.

The SOC was constructed to guard people utilizing machines. It now protects machines utilizing machines. The response window shrank from 48 minutes to 27 seconds. Any agent producing an alert is now a suspect, not only a sensor. The choices safety leaders make within the subsequent 90 days will decide whether or not their SOC operates on this new actuality or will get buried below it.

Source link