Cisco Safety and Splunk Safety launched the Findings Report from the Safety Operations Heart at RSAC 2026 Convention.
This 12 months marked the tenth 12 months of the SOC at RSAC. Since 2017, the mission has stayed constant: shield the convention community, educate attendees about what occurs on an open wi-fi community, and innovate with new integrations, workflows, and safety operations practices.
The 2026 SOC was additionally an vital step towards one thing larger. We weren’t but working a totally agentic SOC at RSAC 2026, however the basis was taking form: built-in telemetry, automated escalation, full packet proof, AI-protected workflows, and a closed-loop working mannequin between Cisco XDR and Splunk Enterprise Safety. These classes helped inform the Agentic SOC work that adopted at Cisco Reside Americas 2026.
RSAC is a uniquely helpful surroundings for studying. The Moscone Heart wi-fi community is open and unsecured, just like the networks folks use each day in resorts, airports, espresso outlets, and main occasions. The SOC doesn’t decrypt encrypted site visitors. As an alternative, the staff makes use of community telemetry, DNS visibility, packet seize, menace intelligence, and built-in safety instruments to establish danger, examine suspicious exercise, and assist attendees higher shield themselves.
For RSAC 2026, the staff deployed the SOC in a Field structure, connecting Endace full packet seize, Splunk Enterprise Safety, Cisco XDR, Cisco Safe Firewall, Cisco Safe Entry, Cisco AI Protection, ThousandEyes, Splunk Assault Analyzer, Cisco Safe Malware Analytics, Cisco Talos intelligence, and associate (alphaMountain, Pulsedive and StealthMole) and neighborhood menace intelligence sources.
The complete report consists of the main points, however just a few themes stood out.
First, integration modified how the SOC labored. Cisco XDR supported environment friendly triage and correlation, whereas Splunk Enterprise Safety supported deeper investigation, looking, enrichment, and reporting. Splunk SOAR helped join the workflow in order that context may transfer between programs as an alternative of forcing analysts to manually re-enter proof or change consoles to grasp what occurred.
Second, automation decreased toil. Cleartext credentials continued to seem on the community, however the staff superior the response mannequin from standalone scripting to an built-in Splunk SOAR workflow. Detections grew to become formal findings in Splunk Enterprise Safety, and the playbook may notify affected customers, replace the discovering, and shut the case. That saved greater than 9 hours of analyst time in the course of the occasion and created a repeatable mannequin for future conferences.
Third, encrypted site visitors remained each a hit and a problem. Encryption helps shield attendee privateness, and the SOC doesn’t decrypt attendee site visitors. However defenders nonetheless want methods to establish threats. Cisco Safe Firewall’s Encrypted Visibility Engine helped the staff discover significant indicators in encrypted classes with out decryption, together with exercise that supported a malware investigation and response.
Fourth, AI grew to become a part of the safety story in two methods. The SOC used Cisco AI Protection to realize visibility into generative AI utility utilization and to assist shield on-premises AI fashions working within the SOC in a Field. On the similar time, the staff noticed that AI demonstrations and agentic purposes can introduce danger when they’re constructed or operated with out primary safe communication controls.
Lastly, the human mission of the SOC remained the identical. The report consists of examples of unintended knowledge publicity, insecure e-mail, unsecured internet purposes, misconfigured entry paths, uncovered storage, phishing infrastructure, rip-off domains, and malware investigations. In every case, the purpose was not solely to detect the difficulty, however to assist RSAC and affected attendees perceive and scale back the danger.
That’s the reason the complete Findings Report issues. It isn’t only a record of alerts. It’s a area report from a dwell, high-pressure SOC working in an actual convention surroundings, the place know-how, course of, automation, AI, and human judgment all need to work collectively.
Obtain the complete RSAC 2026 SOC Findings Report back to see the structure, metrics, investigations, classes realized, and proposals from the tenth 12 months of the SOC.
The core recommendation stays easy: encrypt, encrypt, by no means belief, and at all times confirm.
Our due to the engineers, analysts and companions who made the SOC attainable.
Watch the recorded presentation ‘PROTECTED: The seventh Annual Report from the SOC at RSAC’ (RSAC subscription required).
