Why AI Won't Replace Your SOC: Federated Data & APEX Framework | Nicole Beckwith, Cribl
Source: YouTube · Cloud Security Podcast · published Sep 1, 2026 · 37:45
Nicole Beckwith, Senior Director of Security Engineering at Cribl, explains how AI has shifted detection engineering toward behavior-based detections and introduces the portable APEX framework 1:05.
Key Takeaways:
• IOC-based detections (hashes, IPs, domains) are largely obsolete; focus on behaviors and TTPs at the top of the pyramid of pain 5:04
• Writing detections is easy — tuning to your environment prevents false positives and IR burnout 18:50
• APEX chains TTP signals into sequenced, time-boxed detections (like a Ring doorbell firing on a break-in, not passing cars) and runs on any SIEM, data lake, or pipeline 24:24
• Anthropic's GTG-1002 ran a full kill chain in ~15 minutes — too fast for most detections, validating cluster-based detection 27:07
• Audit log sources feeding detections; those used under ~10% can go to a data lake for replay 10:37
• Don't provision AI agents as service accounts — broad scopes and unrotated credentials make misbehavior hard to detect 16:53
AI-era threats demand behavioral, clustered detections — APEX offers a portable path while keeping humans in the loop.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
the hash values, the IP addresses, and the domains with AI are essentially gone. >> A lot of people may even think it's just as simple as pointing an agent to a SOC tool, and suddenly you have a smarter SOC. >> You can write a thousand detections and technically have, you know, the minor attack framework covered within a day, but you're going to seriously piss off your incident response team. The thing that stops looking trustworthy to you is coverage that's mapped to a framework. So, think about minor attack, PCI. You start distrusting that we have a detection for that technique, and it's very different from we could catch that attacker. With the GTG 1002, you know, threat actor, they did all of this under 60 minutes. No human could have done that, right? And so, that's where a lot of det…