20 hours · 3 days

Agentic SOC Masterclass - GCC

Design, govern and deploy multi-agent security operations for sovereign, regulated environments.

20 hours · 3 days

Virtual

Middle East

New

Programme Overview

Gulf organisations are adopting AI quickly, but under strict expectations on data residency, national cybersecurity baselines and accountable local staffing. This masterclass teaches the Agentic SOC model with those constraints built in from the first hour.

Across three days, teams design the agent roster with sovereignty in mind, coordinate agents over open protocols, add reviewer based safety and evaluation, and finish with governance, regional regulation and a defended 90 day rollout roadmap.

Why this training is necessary

Static playbooks and linear workflows strain under alert volume, data sprawl and adaptive adversaries, and single LLM chatbots or generative AI bolted onto a SIEM fall short.
Sovereignty and nationalisation constraints must be design inputs, not afterthoughts: where models run, where data stays, who is accountable and how every agent decision is evidenced to an auditor.
Teams need a defensible path to autonomy through reviewer policy, staged autonomy and audit trails that satisfy auditors and regulators.

Learning Outcomes

After attending this programme, participants will be able to:

Shift the SOC operating model from human analysts to agent teams with human on the loop oversight.
Design the agent roster across core operational, intelligence and orchestration tiers with single page agent contracts.
Choose model hosting on premises, in country or air gapped and map data residency within national frameworks.
Orchestrate multi agent teams over open protocols and resolve disagreement through escalation.
Build reviewer as policy safety, evaluation harnesses and a staged autonomy ladder.
Produce a 90 day Agentic SOC rollout roadmap with governance, audit trails and regional alignment.

1Module 1 — The case for the Agentic SOC

Why static playbooks and linear workflows are straining: alert volume, data sprawl, adaptive adversaries
Why single LLM chatbots and generative AI bolted onto a SIEM fall short: context limits, non determinism, change management risk
From SOC roles to agent roles: detection engineers, hunters and responders mirrored by agents
Human in the loop to human on the loop: the new analyst role
Regional drivers: national digital and AI strategies, compliance led security investment, converged IT OT estates and shared national SOCs
When not to go agentic: small rule bases, deterministic only regulation, no owner for safety policy

2Module 2 — The agent roster: taxonomy, contracts and model choices

Three tiers: core operational, intelligence and orchestration
The ten to fifteen agent target state versus a five agent production deployment: how to start small
Single page agent contracts: system prompt, tool list, output schema, escalation rules
Small language models versus frontier LLMs: latency, data control, cost and hybrid strategies
Sovereign hosting options: on premises, in country cloud and air gapped deployments
Arabic and English: model choice and evaluation for Arabic alert text, phishing lures and reports

3Module 3 — Memory and data foundations

Four tier agent memory: working, episodic, semantic and procedural
OCSF to normalise alerts, threat intelligence and vulnerability data
The internal knowledge store: asset inventory, identity and privilege graph, topology, business impact parameters
Data classification and residency: what memory and logs may be stored where, and when to consult the national data authority
Memory hygiene: provenance, retention and the poisoning risk
Data readiness check: what your SOC must fix before agents can help

4Module 4 — Orchestration patterns and coordination

Hierarchical planner worker, planner decider, handoff and escalation patterns
Event driven messaging over queues such as Apache Kafka
Resolving agent disagreement: majority voting, structured debate and mandatory human escalation
Multi tenant orchestration for MSSPs and shared national SOCs: tenant isolation across agents, memory and policies
Handoffs that degrade gracefully when part of the chain fails

5Module 5 — The open protocol stack: MCP and A2A

MCP for vertical: schema validated access to SIEM, asset inventory, identity and EDR tools
A2A for horizontal: agent discovery through capability cards, task lifecycle, streaming updates and trace identifiers
Why open Linux Foundation governed protocols outlive frameworks
Running the protocols inside restricted networks: in country MCP servers, no egress designs and gateway patterns
Agent identity: workload identity, mutual TLS and least privilege scopes

6Module 6 — Hybrid reasoning and cost aware inference

The AgentSOC framework: perception, counterfactual hypothesis generation, graph based feasibility validation and risk scored action selection
Risk scoring: balancing containment value against business impact with tunable weights
Anomaly gated inference: classical anomaly detection in front of LLM agents to bound cost and latency
Detection engineering at scale: agent drafted rules with test corpora and human spot audit
Agents and OT: observe and recommend by default, action allowed only for tested reversible steps

7Module 7 — The Reviewer Agent and safety as code

Why safety rules do not belong in prompts, and the role of a privileged reviewer
Policy as code inputs: blast radius, confidence, reversibility and always escalate asset lists
Three terminal states: auto execute, auto reject, or escalate to an analyst with the full reasoning chain
Defence in depth: business risk policy plus platform admission control
Mapping reviewer decisions to regulator expectations: who approves, and what evidence is kept

8Module 8 — Adversarial threats and securing the agent estate

Multi hop indirect prompt injection through logs, emails and filenames, and how it can travel across agents
Memory poisoning of episodic and semantic stores
Agents as privileged non human identities: least privilege, privileged access management and immutable audit logs
Protocol and supply chain risks: MCP servers, agent cards, third party agents
Red teaming agents, with OWASP agent security guidance and MITRE ATLAS as references

9Module 9 — Evaluating agents, earning autonomy and designing the workforce

Evaluation harness: replaying historical incidents and tracking precision, recall, analyst override rate and escalation rate
The staged autonomy ladder: shadow, recommend, approve, then autonomous within limits
Workforce design under nationalisation requirements: agents augment, accountable roles stay human and local
Upskilling national talent: from analyst to agent orchestrator and policy curator

10Module 10 — Governance, regulation and build versus buy in the Gulf

Saudi Arabia: NCA Essential Cybersecurity Controls and related OT and cloud controls; SDAIA role in national AI governance
UAE: Information Assurance Regulation, Dubai ISR, central bank guidance on AI and ML, DIFC Regulation 10
Qatar: National Information Assurance standard and data protection law; Bahrain, Oman and Kuwait emerging AI and data rules
Cross mapping to ISO 27001, ISO 42001 and the NIST AI RMF
Audit trails: logging every tool call and agent handoff against a single trace identifier
Vendor and third party due diligence: audit rights, in country support, sovereign cloud options

Team Capstone

Each team designs an agent roster, writes reviewer decision rules and red team findings, and pitches a 90 day rollout roadmap to a panel that plays the regulator.

1Use case and value — process, users, value hypothesis, baseline to beat
2Autonomy level — chosen level and why simpler options fall short
3Tools, data, permissions — sources, tools, identities, scopes, logging per action
4Roles and coordination — roles, contracts, pattern, or the case for one agent
5Approvals and escalation — high stakes checkpoints, escalation to a named owner
6Evaluation plan and KPIs — test set, graders; success, escalation and cost KPIs
7Security and cost controls — safeguards, run budgets, step caps
8Limits and deployment plan — limitations, deployment needs, owners, next steps

What Participants Take Home

Agentic SOC playbook templates
Single page agent contract template
Sovereign hosting and data residency decision map
Orchestration pattern selection guide
Reviewer policy as code template
Evaluation harness and staged autonomy ladder
Regional governance and audit trail checklist

Certificate of Completion

Attendance: completion of all three days, including the final capstone session
Capstone roadmap: 90 day rollout roadmap submitted and presented in the final session
Participation: contribution to team exercises and between session tasks
Self assessment: completed at the start and end, against the outcomes

Upcoming Batch

Middle East

Gulf Standard Time (UTC+4)

Virtual

To be announced

Language:English

Who Should Attend

CISOs and SOC heads in government entities, critical infrastructure operators, banks, telecoms, energy and utilities
Leaders of national, sector and shared SOCs and MSSP or MDR providers serving regulated clients
Detection engineers, SOAR SIEM architects and security architects
GRC, risk and AI governance leads responding to national cybersecurity and AI requirements
AI and platform teams building sovereign or in country AI environments

Prerequisites

Intermediate to advanced. Working knowledge of SOC operations is assumed; no machine learning background is required.

Lead AI Practitioner

Every programme in this catalog is delivered by a senior AI practitioner with more than 10 years of experience building and deploying AI in production for organisations across Europe, the UK and Latin America. Their background spans banking, insurance, healthcare, industry, defence and e-commerce, and includes leading AI research and development as a technical director and acting as a lead data scientist on industrial anomaly detection, predictive maintenance and IoT analytics. They are also an academic director and university lecturer in artificial intelligence who trains enterprise teams directly.

Production LLM assistants, chatbots and voice AI agents integrated with enterprise data and workflows
AI agents running at scale, writing thousands of outputs per day for a European e-commerce company
A multi-agent demand-forecasting system for a major airline, used for dynamic pricing
Credit-risk scoring models built and validated for a European bank
Sensor- and sound-based predictive maintenance and computer-vision defect detection for manufacturers

Interested in This Programme?

Contact our team for seat reservations, group bookings and customisation options tailored to your organisation.

$1,499/ person

Book a Slot

Scheduled cohorts open — for individuals or teams · To be announced

Enquire Now Back to Catalog

300+

Companies Trained Globally

98%

Participant Satisfaction Rate

Industries Served

Trusted By

Book a Slot Enquire Now

Programme Overview

Why this training is necessary

Static playbooks and linear workflows strain under alert volume, data sprawl and adaptive adversaries, and single LLM chatbots or generative AI bolted onto a SIEM fall short.

Sovereignty and nationalisation constraints must be design inputs, not afterthoughts: where models run, where data stays, who is accountable and how every agent decision is evidenced to an auditor.

Teams need a defensible path to autonomy through reviewer policy, staged autonomy and audit trails that satisfy auditors and regulators.

Learning Outcomes

After attending this programme, participants will be able to:

Shift the SOC operating model from human analysts to agent teams with human on the loop oversight.

Design the agent roster across core operational, intelligence and orchestration tiers with single page agent contracts.

Choose model hosting on premises, in country or air gapped and map data residency within national frameworks.

Orchestrate multi agent teams over open protocols and resolve disagreement through escalation.

Build reviewer as policy safety, evaluation harnesses and a staged autonomy ladder.

Produce a 90 day Agentic SOC rollout roadmap with governance, audit trails and regional alignment.

Team Capstone

Each team designs an agent roster, writes reviewer decision rules and red team findings, and pitches a 90 day rollout roadmap to a panel that plays the regulator.

1Use case and value — process, users, value hypothesis, baseline to beat

2Autonomy level — chosen level and why simpler options fall short

3Tools, data, permissions — sources, tools, identities, scopes, logging per action

4Roles and coordination — roles, contracts, pattern, or the case for one agent

5Approvals and escalation — high stakes checkpoints, escalation to a named owner

6Evaluation plan and KPIs — test set, graders; success, escalation and cost KPIs

7Security and cost controls — safeguards, run budgets, step caps

8Limits and deployment plan — limitations, deployment needs, owners, next steps

Certificate of Completion

Attendance: completion of all three days, including the final capstone session

Capstone roadmap: 90 day rollout roadmap submitted and presented in the final session

Participation: contribution to team exercises and between session tasks

Self assessment: completed at the start and end, against the outcomes

Agentic SOC Masterclass - GCC

Programme Overview

Why this training is necessary

Learning Outcomes

Programme Outline

Team Capstone

What Participants Take Home