Detection at Scale

This week is a special episode of the Detection at Scale podcast. I’m usually the one asking the questions, but this time I’m in the guest chair, hosted by Julian Giuca, Panther’s Chief Product Officer. Our conversation covers the journey of building Panther’s AI SOC platform: From the evolution of the SOC from human-led to AI-enabled, the shifts of the last few years that took LLMs from “autocomp...

What does it actually take to automate security operations when you're processing 7 trillion log lines daily and a single missed threat could compromise billions of users? Michael Sinno , Director of Detection & Response at Google , explains how his team handles this with less than 1% requiring human intervention through strategic AI implementation. He explores Google's methodical appr...

What if the real risk isn't adopting AI agents, but refusing to? James Nettesheim , CISO & Head of Enterprise Technology at Block , argues that principled risk-taking beats playing it safe. James shares Block's journey co-designing the Model Context Protocol with Anthropic and building Goose, their open-source general-purpose agent that enables anyone in the company to write security detection...

Ryan Glynn , Staff Security Engineer at Compass , has a practical AI implementation strategy for security operations. His team built machine learning models that removed 95% of on-call burden from phishing triage by combining traditional ML techniques with LLM-powered semantic understanding.  He also explores where AI agents excel versus where deterministic approaches still win, why tuning detecti...

Mike Vetri , Sr. Director of Security Operations at Veeva Systems , reflects on transforming SOC investigations through AI-powered data aggregation and building threat operations teams with the analytical mindset required for proactive defense. Mike introduces the C3 Matrix framework for prioritizing security efforts across centers of gravity, crown jewels, and capability enablers, and explains th...

Gary Hunter , Head of Security Operations at Trustpilot , built a security team from scratch at a company synonymous with trust. Gary shares how his ten-person team leverages AI agents across alert triage, multimodal brand protection, and incident response.  He explores why he and his team treat AI agents like interns with codified guardrails, why competitive prompt testing reveals the best approa...

Vjaceslavs Klimovs , Distinguished Engineer at CoreWeave , reflects on building security programs in AI infrastructure companies operating at massive scale. He explores how security observability must be the foundation of any program, how to ensure all security work connects to concrete threat models, and why AI agents will make previously tolerable security gaps completely unacceptable.  Vjacesla...

Over his 15-year journey through healthcare and financial services security, Ken Bowles , now Director of Security Operations at GreenSky , has collected a plethora of practical strategies for prioritizing crown jewels, managing cloud over-permissions, and building SOCs that scale effectively. He reflects on transforming security operations through AI and intelligent automation and discusses how A...

Tyler Martin , Senior Director of Enterprise Security Engineering & Operations at FanDuel , reflects on revolutionizing security operations by replacing traditional analyst tiers with security engineers supported by custom AI agents. Tyler shares the architecture behind SAGE, FanDuel's phishing automation system, and explains how his team progressed from human-in-the-loop validation to fully a...

George Werbacher , Head of Security Operations at Live Oak Bank , reviews the practical realities of implementing AI agents in security operations, sharing his journey from exploring tools like Cursor and Claude Code to building custom agents in-house. He also reflects on the challenges of moving from local development to production-ready systems with proper durability and retry logic. The convers...

Andrew Casazza , AVP of Cyber Security Operations at Ochsner Health , explores how healthcare organizations navigate FDA-approved medical devices running on legacy operating systems, implement AI-powered security tools while maintaining HIPAA compliance, and respond to threats that now move from initial compromise to malicious action in seconds rather than hours.  Andrew gives Jack his insights on...

Stephen Gubenia , Head of Detection Engineering for Threat Response for Cisco Meraki , shares his evolution from managing overwhelming alert volumes as a one-person security team to architecting sophisticated automated systems that handle everything from enrichment to containment.  Stephen discusses the organizational changes needed for successful AI adoption, including top-down buy-in and proper...

Dave Herrald , Global Head of Cybersecurity GTM at Databricks , tells Jack about transforming security operations through modern data lake architectures and strategic AI implementation. He discusses the practical benefits of separating storage from compute, giving security teams direct control over data retention while maintaining operational flexibility. The conversation explores how organization...

Matt Muller , Field CISO at Tines , knows all about revolutionizing security operations through strategic AI integration and intelligent automation. In his conversation with Jack , Matt explores how traditional SOC models create problematic feedback loops where junior analysts make critical decisions while senior practitioners handle escalations, limiting learning and growth opportunities.  Instea...

In this episode of Detection at Scale, Jack speaks with Erik Bloch , VP of Security, Illumio , about why most security operations teams aren't ready for AI tools and what fundamental processes must be in place first. Erik challenges the industry's obsession with new technologies, sharing stories from his experience transforming underperforming security teams at major companies like Cisco, Salesfor...

Drawing from his experience building enterprise SOCs and teaching thousands of security professionals, John Hubbard , Cyber Defense Curriculum Lead at SANS Institute and host of the Blueprint podcast, tells Jack about how AI is revolutionizing security operations centers, including balancing AI automation with fundamental analyst skills. They also explore practical AI applications in alert context...

Elliot Colquhoun , VP of Information Security + IT at Airwallex , has built what might be the most AI-native security program in fintech, protecting 1,800 employees with just 9 security engineers by building systems that think like the best security engineers. His approach to contextualizing every security alert with institutional knowledge offers a blueprint for how security teams can scale expon...

In this episode of Detection at Scale, Jack speaks with Jacob DePriest , VP of Security/CISO at 1Password , who shares insights from his 15-year journey from the NSA to leading security at GitHub through his current role. Jacob discusses his framework for assessing security programs with fresh eyes, emphasizing business objectives first, then addressing risks, and finally implementing the right se...

In this episode of Detection at Scale, Matthew Martin , Founder of Two Candlesticks , shares practical approaches for implementing AI in security operations, particularly for smaller companies and those in emerging markets. Matthew explains how AI chatbots can save analysts up to 45 minutes per incident by automating initial information gathering and ticket creation. Matthew’s conversation with Ja...

The security automation landscape is undergoing a revolutionary transformation as AI reasoning capabilities replace traditional rule-based playbooks. In this episode of Detection at Scale, Oliver Friedrichs , Founder & CEO of Pangea , helps Jack unpack how this shift democratizes advanced threat detection beyond Fortune 500 companies while simultaneously introducing an alarming new attack surf...

In this special episode of Detection at Scale, Jack welcomes back Matt Jezorek , Panther's new CISO, for an insightful conversation about effective security strategies. Drawing from his experience scaling Amazon's security operations and leading teams at Dropbox, Matt advocates for a simplified approach focused on three core pillars: identity protection, vulnerability management, and detection/res...

Managing security for a device that can autonomously interact with third-party services presents unique orchestration challenges that go beyond traditional IoT security models. In this episode of Detection at Scale, Matthew Domko , Head of Security at Rabbit , gives Jack an in-depth look at building security programs for AI-powered hardware at scale.   He details how his team achieved 100% infrast...

What does AI in security operations actually look like at scale? In this episode of Detection at Scale, Mor Levi , VP of Detection, Analysis, & Response at Salesforce , shares her team's hands-on experience with Agent Force — from achieving 90% automation in initial case triage to setting ambitious goals for full automation.  Her conversation with Jack goes deep into the practical realities: i...

In this episode of Detection at Scale, Jack speaks to Brandon Kovitz , Senior Manager of Detection & Response at Outreach , shares his insights on the evolving landscape of cybersecurity. He discusses the critical role of generative AI in enhancing detection and response capabilities, emphasizing the importance of understanding data to maximize security tools' effectiveness.    Brandon also hi...

In this episode of Detection at Scale, Jack speaks to JJ Tang , CEO and Co-founder of Rootly , about revolutionizing incident management in tech organizations. JJ shares his journey from practitioner to founder and emphasizes the importance of viewing incident management as a cultural and collaborative effort rather than just a tooling issue.    JJ touches on breaking down silos between security a...