Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Mobot is Sumo Logic's conversational interface designed to streamline investigations for SOC analysts and observability users. Ask a question in plain English and get a full SOC analyst-style investigation without writing a query. Inside an Insight, Mobot pulls context like the C2IP, ransomware hash, host, and exfiltration data automatically. A six-word question, "anyone else hit by the campaign?", triggers a full investigation across every mailbox and endpoint tied to that attack, with a link to the raw query behind every answer.

Sumo Logic's SOC Analyst Agent automatically triages every insight within the SIEM, replacing the manual work that used to fall to a tier-one analyst. Using Sumo Logic's own SOC as customer zero, we found that 100% of tier-one alerts are triaged end-to-end by the agent, resulting in a 89% reduction in median time to triage, from 28 minutes to 3 minutes. In this demo, you’ll see.

On this episode of Masters of Data, we take you inside the Dojo AI demo we're bringing to the show floor at Black Hat. We walk through the SOC Analyst Agent, Mobot, and MCP back to back. SOC Analyst Agent triages every tier one alert down to the one that actually matters, and Mobot picks up from there, running the investigation in plain English to track down other phishing victims and lateral movement. We also show how MCP pulls that same insight into Claude or Slack. SOC leads tired of alert fatigue and analyst burnout will want the numbers here: 100% of tier one alerts triaged automatically, and 25 hours a week back per person.

On this episode of Masters of Data, we revisit the predictions Adam White, Zoe Hawkins, and David Girvin made at the end of last year, checking our own scorecard halfway through 2026. The hits: agents running amok and deleting databases, MCP becoming the backbone for tracking what agents actually do, growing security gaps around personal data, and a collective rejection of low-quality AI content. The misses: we underestimated how fast companies would cut staff for AI, then quietly start rehiring once the agents couldn't cover the work, and we're still arguing about whether token burn is a cost problem or a coming attack vector.