Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

When Heathrow, Brussels, and Berlin airports suffered a cyber attack that disrupted their check-in and baggage systems, the fallout was immediate. Flights were canceled, queues stretched through terminals, and staff scrambled to switch to manual processes. For some of Europe’s busiest hubs, this was more than an inconvenience. It was a reminder that disruption, not data theft, is often the attacker’s goal.

In today’s data-driven world, CISOs and senior leadership need to prove that their security programs mitigate risk. Just like grades theoretically quantify how well students understand material their teachers present, cybersecurity metrics quantify your security controls’ effectiveness. As the threat landscape becomes more complex, security teams struggle to identify the metrics that best showcase their value.

At.conf25, we announced how Splunk Enterprise Security (ES) has transformed to today’s AI-powered SecOps platform—unifying industry-leading technologies across SIEM, SOAR, User and Entity Behavior Analytics (UEBA), threat intelligence, and detection engineering with purpose-built AI across the entire Threat Detection, Investigation, and Response (TDIR) workflow—empowering Security Operations Centers (SOCs) to end analyst fatigue, deliver faster security outcomes, reduce risk, and build r

Security analysts work on the front lines, responsible for protecting organizations every hour of the day from all threats. Our mission has always been to empower the SOC with end-to-end visibility to focus on what matters most and act with clarity, context and speed to resolve any attack.

AI is transforming how security operations centers (SOCs) work, but the hype can outpace the reality. You don’t need to build custom models or deploy cutting-edge platforms to benefit. Chances are, you already have AI-powered capabilities in your SIEM, SOAR, or security data platforms. The question is: Are they doing anything useful? This practical playbook lays out six key priorities to increase productivity and effectiveness while maintaining control.

Phishing threats remain one of the most common and effective attack methods. Research shows it contributes to over 34% of confirmed breaches. The financial impact is significant as well, with credential-related breaches averaging $4.76 million per incident. And despite years of security awareness training, nearly a third of employees still click on simulated phishing emails. Why does phishing work so well? Attackers exploit gaps in visibility, speed, and user behavior.

AI agents (utilizing LLMs and RAG) are being used within SOCs and SIEMS to both help identify attacks and assist analysts with working more efficiently; however, I’ve done a little bit of research one sunny British afternoon and found that these agents can be abused by attackers and made to go rogue. They can be made to modify the details of an attack, hide attacks altogether, or create fictitious events to cause a distraction while the real target is attacked instead.

Imagine security data and analytics like a carnival’s hall of mirrors. From convex mirrors that show you a shorter, squatter version of something to the concave mirrors that show a highly magnified image, you see the same object in multiple ways. Every view gives you a different insight and provides a unique vantage point. Online Analytical Processing (OLAP) systems are different mirrors that allow security teams to create focused analytics models for different insights about your security posture.