Why AI Won't Replace Your SOC: Federated Data & APEX Framework

Hash values, IP addresses, and domains are virtually useless as primary detection mechanisms in the era of AI-driven polymorphic malware and short-lived phishing kits. If your detection strategy is still stuck at the bottom of the Pyramid of Pain, your incident response team is doused in noise while true threats slip through undetected. In this episode, Ashish sits down with Nicole Beckwith, Senior Director of Security Engineering & Operations at Cribl (former Secret Service investigator and Kroger security ops lead), to break down Cribl's open APEX framework. Nicole explains how APEX focuses on behavioral chaining, time-boxing, and clustering over raw telemetry to build high-fidelity detections without needing a thousand individual rules for every MITRE ATT&CK box. We also explore the shift from a "single pane of glass" to a deterministic "single lens" over federated data, why AI agents must be provisioned as true identities rather than unmonitored service accounts, and how to analyze hyper-fast threat archetypes like Anthropic's GTG 1002.

Guest Socials -⁠⁠ Nicole's Linkedin

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

If you are interested in AI Security, you can check out our sister podcast -⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ AI Security Podcast

Questions asked:

(00:00) Introduction & The Death of Hashes and IP Detections(02:20) Nicole Beckwith's Background (Secret Service, GE Aerospace, Kroger, Cribl)(04:30) Moving Up David Bianco’s Pyramid of Pain to TTPs(06:20) Replacing the "Single Pane of Glass" with a Single Lens on Federated Data(09:40) Deciding What Logs to Pipe to a Data Lake vs. Keep in a SIEM(13:30) The Cost and Context Risks of Pointing AI Agents Directly at Unstructured Data Lakes(16:30) IAM Mistakes: Why AI Agents Must Be Provisioned as Identities, Not Service Accounts(18:40) The Biggest Blind Spot in AI Detection Engineering (Rule Writing vs. Tuning)(20:40) Why AI SOCs Break on Normalized Schemas and Need Raw Telemetry(22:20) Deconstructing the APEX Framework: Chaining, Time-Boxing, and Clustering(27:00) Detecting Anthropic’s GTG 1002 Archetype and MCP Scaffolding Abuse(30:30) How to Apply the APEX Framework to Any Existing Security Stack(34:20) Empowering Analysts: Why AI Should Not Be Used to Cut SOC Headcount

Resources spoken about during the interview

APEX Framework

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(360)

Securing Millions of AI-built Apps: How Lovable Defends Against Insider Threats

Empowering non-technical users to build production-grade applications requires a proactive, secure-by-design architecture. In this episode, Ashish sits down with Marcus Hallberg and Samuel Kelemen, se...

11 Sep 1h 10min

The "Hunt First" AI Security Strategy

Did you know that 82% of all intrusions don't involve any sort of malware, and AI-augmented attacks are up 89% year over year? If your security operations team is solely focused on reacting to known-b...

25 Aug 46min

Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane?

When Claude Cowork hits a roadblock, it doesn't give up, it writes a custom Python script and downloads an untrusted NPM package just to bypass its restrictions and finish its goal. Are your security ...

18 Aug 32min

How Adobe Uses AI Agents for building a WAF Pipeline?

When vulnerability disclosures shrink the wild exploit window down to less than 24 hours (or even minutes), traditional manual patching and WAF rule creation simply cannot keep up.In this episode, Ash...

4 Aug 47min

Why Runtime Agents Are Replacing Static Posture Checks

The attack window from the discovery of a vulnerability to its exploitation has shrunk to less than 24 hours and sometimes down to just 25 minutes. Is your security team prepared for the speed of AI-d...

28 Juli 44min

The Hidden Cost of BlackBox AI: Bridging Cloud and Code Security

Traditional SCA and SAST tools are notorious for drowning security teams in false positives, historically flagging nine out of ten alerts incorrectly. But while generative AI seems like a magic bullet...

9 Juli 42min

Who Governs Your AI Agents? Identity, Offboarding & Open Standards

Are overprivileged AI agents the biggest emerging threat in cybersecurity? In a recent high-profile attack, a vibe-coding company had its entire source code stolen because an attacker exploited a long...

2 Juli 34min