A Black Hat 2026 recap on how security leaders' questions about AI in the SOC have shifted from "what can it do" to "what should it be trusted to do."

A three-week dwell period, 45 encrypted devices, and a backup infrastructure under active destruction — see how Critical Start's SOC isolated the environment and severed C2 in just 7 minutes.

A phishing email, a PowerShell backdoor built to evade detection, and 23 minutes standing between initial access and full containment — see how Critical Start's SOC shut down an advanced C2 channel before it could exfiltrate data.

A trusted domain, a malicious Word doc, and a "low priority" alert that almost got closed — see how Critical Start's SOC recognized the real threat and shut it down in 18 minutes.

Four employees, one lookalike "IT Support" account, and a chain of Microsoft-signed tools built to slip past every file-reputation check — see how Critical Start's SOC untangled a coordinated social engineering campaign in 13 minutes.

When an attacker bypassed MFA with a proxy-based phishing kit, Critical Start's SOC turned a low-priority alert into a full containment — revoking sessions, resetting credentials, and shutting the door in just 17 minutes.