ADMIN.FOUNDATION

  • When Your SOC Analyst is Also a Bot: AI Agents, MCP, and Many Automation Opportunities in Your Security Operations

    ·

    From AI Experiments to Autonomous Operations

    – Christophe Briguet, Sr. Director of Product Management – AI & Security Analytics, Stellar Cyber

    San Jose, Calif. – Apr. 28, 2026

    Something shifted in early 2026. Not gradually — more like flipping a switch.

    For years, we talked about AI in the SOC the way we talked about self-driving cars: always five years away, always needing “just a bit more data.” Then MCP (Model Context Protocol) happened. Then agentic frameworks stopped being demos and started being tools. And suddenly the question wasn’t “can AI help security teams?” but “what should we let it do first?“

    I know because I’ve been running one.

    The Agentic Breakthrough Nobody Saw Coming

    Here’s what changed: AI agents stopped being chatbots with API access and started being actual coworkers, ones that remember yesterday, know how to use your tools, and can make calls on their own.

    MCP, originally created by Anthropic and now under the Linux Foundation, gave us something we didn’t have before: a universal way for AI agents to connect to real systems. Not through brittle integrations or custom code. Through a standardized protocol that lets any AI agent talk to any tool, any API, any platform. Think of it as USB for AI: plug in a new capability, and the agent just uses it.

    At Stellar Cyber, we shipped MCP support in our platform. An AI agent can now connect to a Stellar Cyber instance and immediately access case management: listing cases, pulling full investigation details with MITRE mappings and observables, updating status, assigning analysts. One API call returns what used to take eight clicks and three tabs.

    But MCP is just the connector. The real breakthrough is what sits on top of it: agentic AI that remembers context, plans multi-step workflows, and acts on your behalf between sessions.

    What I Learned Running an AI Agent for a Week

    I didn’t just theorize about this. I built an AI agent that connects to my actual work systems (email, calendar, project management, documentation tools, and Stellar Cyber’s MCP server). I put it to work on real security operations tasks.

    Here’s what it did in a single day:

    • Wrote two customer emails about feature capabilities. Pulled context from a 10-message email thread, cross-referenced the KB, got the technical details right
    • Filed a Jira ticket. Got the required fields wrong twice, figured out the API, nailed it on the third try
    • Scheduled a meeting across four people by checking everyone’s calendar. Found the one open slot on Wednesday morning
    • Reviewed a process doc on Confluence and the matching Figma board. Found five gaps nobody had noticed
    • Pulled 30,000 cases from our Stellar Cyber MCP server in one call. Full MITRE mappings, observables, the works
    • Set up a cron job to watch a Google Form for new submissions, auto-create tickets, and ping me when something comes in. No code. It took about ten minutes.

    That’s not a demo. That’s a Tuesday.

    The Other Side of This

    Here’s where it gets uncomfortable. Everything I just described? Adversaries can do it too.

    If an AI agent can connect to your ticketing system, read your escalation tickets, cross-reference your knowledge base, and understand your detection gaps? That’s a free roadmap to everything you’re bad at defending. The same agentic capabilities that make defenders faster also make attackers more systematic.

    MCP is a double-edged sword. CrowdStrike already published research on securing agentic AI deployments against prompt injection and privilege escalation. The attack surface isn’t theoretical. It’s the exact same integration points that make agents useful.

    The threat landscape shift is this: the speed advantage that SOC teams had over scripted attacks is disappearing. Adversaries with agentic tools can now:

    • Enumerate your environment faster than your analysts can triage alerts
    • Generate social engineering content that’s contextually aware of your organization
    • Automate lateral movement decisions the way we automate triage decisions
    • Adapt tactics in real-time based on what’s working

    So what do you do? You make your defensive automation faster, smarter, and more connected than their offensive automation. Which brings us to the opportunities.

     Many Automation Opportunities

    After running an AI agent against real security operations workflows, six clear automation opportunities emerged. These aren’t aspirational. They’re things I watched an agent do (or nearly do) this week.

    1. Alert and Case Triage at Machine Speed

    This is the obvious one, and it’s where Stellar Cyber’s Alert Auto-Triage already operates. The agent runs Verdict Signal Checks against every critical case: IP reputation, behavioral anomalies, entity relationships, and device vulnerability. Then it delivers a verdict: True Positive, Benign, False Positive, or Inconclusive.

    What’s new is the feedback loop. When an analyst overrides a verdict, that override becomes a training signal. Not in the vague “we’ll retrain the model someday” sense. In the “the next time this pattern appears, the system weighs your judgment” sense. Tesla FSD learns from human takeovers. So does this.

    The agentic unlock: An MCP-connected agent can now pull case details, correlate with external threat intel, check historical verdicts on similar patterns, and deliver a triage decision with full explainability, without a human clicking through five tabs.

    2. Intake and Onboarding Automation

    Requests come through a form. Historically, someone reads the submission, creates a tracking ticket, checks prerequisites, and sends a confirmation email. Four systems, three context switches, one person doing manual data entry.

    An agent monitors the intake source on a schedule. When a new entry appears, it creates the ticket with the full structured description, writes the reference back to the source, and sends a notification with a summary. Zero manual steps.

    The agentic unlock: This pattern generalizes to any intake process. Trial requests. Compliance inquiries. Vulnerability disclosures. Customer escalation routing. Any workflow that involves “read from source A, create in system B, notify via channel C” is a candidate.

    3. Detection Quality Feedback Loop

    This is the one that excites me most. Security vendors accumulate enormous backlogs of “this detection doesn’t work right” tickets. The descriptions are often cryptic. The context is buried in email threads and support tickets. The person triaging needs deep product knowledge to even understand the ask.

    An AI agent with access to your ticketing system, knowledge base, and security platform can read a detection feedback ticket, pull the actual alert data, cross-reference with documentation, and produce a clear summary: “This is a false positive caused by substring matching in rule X. The reporter provided a fix. Here’s the corrected query.”

    The agentic unlock: Connect the agent to the reporting environment (with permission) via MCP, and it can validate the reported issue against live data. No more “can you send a screenshot?” No more three-week back-and-forth. The agent sees what the reporter sees.

    4. Connecting the Dots Across Tools

    A security operations leader’s job is connecting dots across systems. An email thread about a partner engagement, a ticket about a detection gap, a wiki page about process, a design board about workflow, pricing in a sales thread. These live in different tools with no automatic correlation.

    An AI agent traverses all of these. Ask it “what’s the status of this partner’s trial?” and it pulls the email thread, checks the tracking ticket, reads the intake form, and synthesizes a single answer. No tab switching. No “let me check.”

    The agentic unlock: This is where MCP shines. Each system is an MCP server. The agent doesn’t care if the data is in email, Jira, or Stellar Cyber. It speaks the same protocol to all of them.

    5. Proactive Monitoring Without Alert Fatigue

    The traditional approach to monitoring is either “check everything constantly” (expensive, noisy) or “wait for someone to notice” (slow, risky). AI agents offer a third path: scheduled, intelligent checks with human-level judgment about what’s worth escalating.

    My agent checks communication channels periodically, but it doesn’t just report “you have 15 unread messages.” It categorizes by urgency, identifies action items, filters noise, and only alerts me when something actually needs attention. The same pattern applies to security monitoring: check case queues, flag anomalies in detection coverage, monitor SLA breaches. And stay quiet when everything’s normal.

    The agentic unlock: Scheduled agent runs with model-tier optimization. Use a lighter model for routine checks, escalate to a more capable model when the situation requires judgment. Cost-aware automation.

    6. Documentation and Knowledge Capture

    Security teams generate enormous amounts of institutional knowledge that never gets documented. The analyst who knows that a specific firewall vendor’s log entries behave differently than expected? That knowledge lives in their head until they leave.

    AI agents can capture and structure this knowledge in real-time. Every ticket triage, every interaction, every decision becomes a structured entry in a persistent knowledge base. The agent maintains daily notes, updates its long-term memory with distilled insights, and cross-references new information against what it already knows.

    The agentic unlock: The more the agent works, the more it knows. The agent that triaged a batch of detection tickets now understands vendor-specific log quirks, integration edge cases, and identity correlation gaps. Next time a related ticket comes in, it starts from that base — not from zero.

    What This Means for Security Teams

    The security industry has spent the last decade building detection. The next decade is about decisions. Who decides what’s real? Who decides what to do about it? And how fast can those decisions happen?

    Agentic AI doesn’t replace the analyst. It gives the analyst leverage. The same analyst who manually triaged 20 cases a day can now review 200 agent-triaged cases, focusing their expertise where it matters: the edge cases, the novel attacks, the judgment calls that machines can’t make yet.

    The vendors still hiding behind closed APIs and one-shot AI summaries are going to get left behind. The platforms that win will be the ones that open their APIs through protocols like MCP, build feedback loops that actually learn from human decisions, and treat AI automation as a product, with accuracy metrics, cost controls, and governance rails.

    We’re building that at Stellar Cyber. The MCP server is live. Alert Auto-Triage is in production. And I have an AI agent that just drafted this blog post.

    Well, most of it.

    Christophe Briguet is Sr. Director of Product Management – AI & Security Analytics at Stellar Cyber, where he leads the Autonomous SOC product direction. He’s still figuring out where the line is between helpful and creepy.

    About Stellar Cyber

    Stellar Cyber’s Open XDR Platform delivers comprehensive, unified security without complexity, empowering lean security teams of any skill level to secure their environments successfully. With Stellar Cyber, organizations reduce risk with early and precise identification and remediation of threats while slashing costs, retaining investments in existing tools, and improving analyst productivity, delivering an 8X improvement in MTTD and a 20X improvement in MTTR. The company is based in Silicon Valley. For more information, visit https://stellarcyber.ai.

    The post When Your SOC Analyst is Also a Bot: AI Agents, MCP, and Many Automation Opportunities in Your Security Operations appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code

    ·

    A critical security vulnerability has been disclosed in Gogs, a popular open-source self-hosted Git service, that allows an authenticated user to execute arbitrary code under certain conditions. The security flaw, per Rapid7, is rated 9.4 on the CVSS scoring system. It does not have a CVE identifier. “The vulnerability allows any authenticated user to achieve remote code execution (RCE) on

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Navy used drones to sink a retired warship

    ·

    A U.S. warship used aerial and maritime drones to help sink a decommissioned frigate last fall, Fourth Fleet officials have confirmed, adding that the experience is now shaping how the Navy will go into future battles.

    On or about Sept. 28, somewhere in the Fourth Fleet’s slice of the Atlantic Ocean, the littoral combat ship Cooperstown launched four unmanned aerial vehicles and one unmanned surface vessel against the former USS Simpson, a Perry-class guided missile frigate that was until recently the last modern U.S. Navy vessel to have sunk an enemy warship. 

    The robot formation executed three kinetic strikes against the Simpson as part of live-fire attacks that put the hull on the bottom and capped the weekslong, multinational UNITAS 2026 exercise.

    Neither the drones’ participation in the SINKEX nor the identity of the warship that went to its watery grave appear to have been previously confirmed.

    The drone attack was largely coordinated by personnel ashore, not aboard the relatively lightly crewed Cooperstown, a Fourth Fleet spokesperson said.

    “The exercise was primarily commanded from the Maritime Operations Center, MOC, ashore, with some senior staff elements afloat. The Robotics Operations Coordinator was part of the element ashore at the MOC, monitoring the status of each [automated unmanned system] and event serials in which they participated,” the spokesperson said via email. “We also conducted coordinated anti-submarine warfare against a diesel submarine using long-dwell USVs with acoustic capability.” 

    The Navy is refining its approach to assessing and buying unmanned surface vessels as it works to integrate drones across domains into its fighting structure.  

    Could data centers at sea set drones free?

    Situational awareness experiments were also conducted aboard Cooperstown, such as using flying drones to collect targeting data. These were underpinned by a “deployable data center” transported from Mayport, Florida, set up in Norfolk, Virginia, and ultimately put aboard the littoral combat ship. The data center, provided by Armada, was equipped with AI and machine-learning tech, including computer vision and tested maritime domain awareness technologies. It was the first time the company’s product was tested at sea. 

    Logistics delays, including a hurricane, kept the devices from processing much of the exercise data, but nevertheless provided “an excellent proof of concept,” the Navy spokesperson said. “The team engineered electrical and data connectivity in record time, and the ship transported the DDC on the next leg of its deployment, providing edge computing power at sea.”

    Lawmakers have proposed to spend $10 million for “deployable data centers that deliver remote and resilient edge computing” under Navy experiments and demonstrations in a draft 2027 defense policy bill. 

    During the exercise, the Cooperstown launched four aerial drones, including a medium-sized Group 3 UAV whose collection could be used to train AI targeting models in a crowded maritime environment. 

    “The UAV launched from the [robotic and autonomous systems] mothership and captured imagery of [more than 20] naval vessels during the multinational exercise,” the Fourth Fleet spokesperson said. “With very few global opportunities to capture data on dozens of different classes of ship in close formation, the traffic density helped train and improve the AI model significantly more quickly than multiple individual flights in less complex environments.”

    Each aerial drone flew at least once and flights were planned around known and weather-related limitations—an incoming hurricane shortened the exercise. But the hope is to increase that in the future. 

    “There were limitations on when UAVs could fly in order to maintain safety of flight. Exercise event schedules, ship maneuvering, manned aircraft flights, gunnery exercises, and competing demands for flight deck space all impacted planned UAV operations,” the spokesperson said, noting that some flights were cut short for safety reasons revolving around drones operating near manned aircraft. 

    “The commander prioritized safety and successful exercise execution and temporarily paused most UAV flights for a few days, pending engineering analysis of a particular suspected communications interference issue.”

    Overall, the Navy said, the robot mothership was a success, particularly with the pre-planning for how the systems would be used and the infrastructure, such as battery power and hangar space. 

    But there’s always room for improvement, including more ship connectivity and someone to lead the robots. There wasn’t an onboard robotics specialist during the exercise—something that could change.

    “For future mothership deployments, a dedicated robotics officer in charge or liaison could be beneficial,” the spokesperson said. “Although each team knew their individual [tasks], we will mandate more comprehensive mission briefs with the ship’s operations staff.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The CISO Whisperer’s Watch List For The Gartner Security & Risk Management Summit 2026

    ·

    New York, USA, 28th May 2026, CyberNewswire

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer

    ·

    Threat actors are continuing to exploit a critical, now-patched security flaw impacting FortiClient Endpoint Management Server (EMS) deployments to deliver credential-stealing malware. “The campaign abused trusted endpoint management infrastructure to deliver malware across managed endpoints,” Arctic Wolf said. “Threat actors disguised the credential stealer payload as a Fortinet endpoint

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal

    ·

    Microsoft has come out strongly in favor of Coordinated Vulnerability Disclosure (CVD), urging the research community to share their findings and give affected vendors an opportunity to better understand the impact and address them before they are publicly disclosed. The development comes after a researcher named Chaotic Eclipse (aka Nightmare-Eclipse) disclosed details of multiple zero-day

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Pivot from marimo RCE to Internal Database Using LLM Agent

    ·

    ,

    A newly observed intrusion demonstrates how attackers are replacing static playbooks with AI-driven agents that adapt in real time. The attack began on May 10, 2026, როდესაც threat actors exploited CVE-2026-39987, a remote code execution flaw in the marimo notebook environment. Once inside, the attacker harvested cloud credentials from environment files and system paths. Unlike […]

    The post Hackers Pivot from marimo RCE to Internal Database Using LLM Agent appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More

    ·

    Every time you think the industry has finally stopped doing some reckless, low-effort crap, somebody spins up a fresh box full of sketchy loaders, fake installers, recycled social-engineering bait, and enough exposed infrastructure to make you wonder if prod is just a public beta now – meanwhile some researcher casually drops a technique that turns a “minor” foothold into total account

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Sri Lanka CERT Reports Sharp Rise In Phishing And Ransomware Incidents

    ·

    This week in cybersecurity from the editors at Cybercrime Magazine

    Sausalito, Calif. – May. 28, 2026

    – Read the full story in Daily Mirror

    Hilmy Cader warns that the intensity and sophistication of cybercrime, now supercharged by the pervasive use of Generative AI, is overwhelming governments, enterprises and consumers worldwide.

    “Cybersecurity must be treated as a strategic emergency,” says Cader, CEO at MTI Consulting, an international strategy consultancy with offices in Africa, Australia, England, Bahrain, Canada, and Sri Lanka.

    Cybersecurity Ventures predicted that global cybercrime costs would reach $ 10.5 trillion USD annually by 2025 — making it the world’s third-largest economy, if measured by GDP. This staggering figure underscores the scale of the threat and the need for immediate action.

    Sri Lanka, an island country lying in the Indian Ocean with a population of around 22 million, is not immune.

    The Sri Lanka Computer Emergency Readiness Team continues to report a sharp rise in phishing and ransomware incidents. As Sri Lanka accelerates digital adoption in banking, e-commerce and government services, the risks of cybercrime grow exponentially.

    The Morning reports that local experts warn weak governance and poor awareness are leaving State systems exposed and that Business Email Compromise (BEC) is also on the rise.

    Read the Full Story

    Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

    • SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
    • NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
    • HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
    • VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
    • M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
    • BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
    • PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
    • PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
    • RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

    Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

    The post Sri Lanka CERT Reports Sharp Rise In Phishing And Ransomware Incidents appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Malicious Websites Exploit SSD Timing Signals to Monitor Visitor Activity

    ·

    ,

    Malicious websites can now exploit subtle SSD timing signals in modern browsers to quietly track what users are doing on their devices, including which sites and apps they open, using a new side‑channel technique called FROST. Security researchers Hannesweissteiner have revealed that a single drive‑by visit to a booby‑trapped page is enough for an attacker […]

    The post Malicious Websites Exploit SSD Timing Signals to Monitor Visitor Activity appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶