Building on conversations with CISOs across North America and APAC, we're bringing the Agentic SOC Executive Series to Europe.

This is a working session with other security leaders on where Agentic AI actually stands right now — what it's ready to handle, what teams are still testing, and what nobody's solved yet.

AI is accelerating both attacks and defence, and a lot of our infrastructure wasn't built to run at that speed. Security and network teams are already feeling the strain.

At the same time, teams are standing up their own AI agents faster than anyone can track them. Shadow AI and unsanctioned agents are creating blind spots most of us don't have a good answer for yet.

Getting to accurate, real-time response means correlating data and context across the environment — that's the core problem we'll work through together.

Here are some of the questions we want to address:

• How network data and context support agentic AI operations
• The current state of autonomous, AI-driven attack techniques
• Why investigation remains the biggest bottleneck across operations teams
• Where AI is delivering real value and where it’s still creating noise
• What leading teams are doing differently across SOC and NOC

Frontier AI models can now find vulnerabilities, chain exploits and adapt to defences faster than any human-run process can respond. The window between a vulnerability being discovered and being exploited is collapsing, and the operating model most SOCs and NOCs still run on — queue, enrich, triage, investigate — was never built for an adversary that moves at machine speed.

Bolting another copilot onto the SIEM does not change that. The question senior security leaders across North America and APAC have been working through with Greg Clark over the past year is a different one: what does an operating model designed for autonomous threats actually look like, and what has to sit underneath it for you to trust it?

This is the European leg of that conversation. It is a working session, not a briefing: a room of about 20 peers, one host, and no product pitch.

In three hours you will:

• See a live AI-driven investigation on real network data — two prompts, zero analyst keystrokes after, and a complete, auditable evidence trail from first signal to blast radius.

• Work through the architecture your peers are converging on — context, harness, model — and where your own SOC and NOC sit against it today.

• Leave with the language to describe this shift to your board, and a set of questions worth asking any vendor, including us.

Questions the room will work through:

• What context can your agents actually trust — and where does it come from?

• Who decides what an agent is allowed to do, and how do you prove it stayed inside that line?

• What happens when the model changes next month?

• What happens to the SIEM?

• What does the analyst role look like in eighteen months?

Bring your hardest question. That is what the working session is for.