0x356 - Teknik - Rewiring the SOC: From Detection as Code to Agentic MDR in Production (bsides)

0x356 - Teknik - Rewiring the SOC: From Detection as Code to Agentic MDR in Production (bsides)

Title history
  • 0x356 - Teknik - Rewiring the SOC: From Detection as Code to Agentic MDR in Production (bsides) — observed on 20261024-2121 UTC (YouTube)

by PolySécure Podcast (guest: Pierre Colard) · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 PolySécure Podcast (guest: Pierre Colard) 👥 555 📅 October 24, 2026 ⏱ 42 min 👁 0 📄 expert opinion 🧭 2026-10-24
Available in: English (current) Français

Keywords

AI securitySecurity Operations CenterAgent automationCybersecurity governanceDetection as code

Summary

In this podcast episode, Pierre Colard from Sopra Steria discusses the modernization of Security Operations Centers (SOCs) with AI. He argues that while AI has great potential for detection and investigation, operational maturity is often lacking. He emphasizes that organizations need clear context, historical data, and a defined authority framework before delegating decisions to agents. The conversation covers the three key elements required for AI integration: context (understanding business and security policies), history (learning from past incidents), and authority (what actions can be automated). He also discusses the importance of data hygiene, CMDB accuracy, and measuring AI effectiveness through KPIs. An example illustrates how a defensible decision depends on organizational context. The episode highlights that AI is not a magic solution; it requires substantial groundwork in governance and data quality.

130 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value lies in the practical, experience-based insights from a professional who works with various clients. The argumentation is coherent, structuring the discussion around the three pillars of context, history, and authority. The speaker provides concrete examples and emphasizes that AI adoption is not just technical but requires organizational readiness. The arguments are persuasive, though they rely on anecdotal evidence rather than empirical data.

Scientific Rigor, Source Quality, Title Accuracy

The video does not cite specific external sources, but the speaker draws on his professional experience. The title accurately reflects the content, which discusses moving from detection as code to agentic MDR. However, the discussion is more general and does not delve deep into the technical specifics of detection as code. The lack of references limits the scientific rigor, but as an expert opinion it is credible. The description is empty, providing no additional sources.

154 words

Title / Content Match

The title accurately reflects the content, which discusses modernizing SOC with AI and moving towards agentic MDR, though the technical depth of 'detection as code' is limited.

Quality & Reliability

7/10

The speaker is an experienced professional providing practical insights, but no external sources are cited, limiting verifiability.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Contribution & Novelties

The video contributes a practitioner’s perspective on the integration of AI in SOCs, emphasizing that operational maturity is a prerequisite for effective automation. It proposes a framework of context, history, and authority to guide delegation decisions. The discussion underscores that AI is not a silver bullet and requires substantial organizational groundwork.

Pour aller plus loin :

95 words

Radar Profile

The radar profile shows a balanced but modest score across all dimensions. The strength is in the quality of information and the practical value, while the technical depth and reliability are slightly lower due to the lack of cited sources. This indicates a useful expert discussion rather than a detailed technical tutorial.

Reliability 6/10