20 hours · 3 days

Agentic SOC Masterclass — North America

Design, govern and deploy multi-agent security operations under US and Canadian expectations.

20 hours · 3 days

Virtual

North America

New

Programme Overview

North American security teams face a mature but crowded market: strong platform vendors, established MDR and MSSP options, round the clock coverage pressure, and growing expectations from boards, regulators and auditors about how AI is governed.

This masterclass teaches the Agentic SOC model against that backdrop, with emphasis on standards led governance, defensible audit trails and a clear build, buy or MDR decision.

Why this training is necessary

Static playbooks and linear workflows strain under alert volume, data sprawl and adaptive adversaries, and single LLM chatbots or generative AI bolted onto a SIEM fall short.
Standards led governance and disclosure expectations are moving quickly: NIST CSF 2.0, NIST AI RMF, SP 800 53, the Cyber AI Profile and CAISI agent standards initiative.
Teams need a defensible path to autonomy through reviewer policy, staged autonomy and audit trails that support incident materiality decisions and board reporting.

Learning Outcomes

After attending this programme, participants will be able to:

Shift the SOC operating model from human analysts to agent teams with human on the loop oversight.
Design the agent roster across core operational, intelligence and orchestration tiers with single page agent contracts.
Map memory, data sources and regulatory touchpoints for US, Canadian and EU AI expectations.
Orchestrate multi agent teams over open protocols and resolve disagreement through escalation.
Build reviewer as policy safety, evaluation harnesses and a staged autonomy ladder.
Produce a 90 day Agentic SOC rollout roadmap with governance, audit trails and market aware build buy or MDR decisions.

1Module 1 — The case for the Agentic SOC

Why static playbooks and linear workflows are straining: alert volume, data sprawl, adaptive adversaries
Why single LLM chatbots and generative AI bolted onto a SIEM fall short: context limits, non determinism, change management risk
From SOC roles to agent roles: detection engineers, hunters and responders mirrored by agents
Human in the loop to human on the loop: the new analyst role
Market context: copilots and platform agents from major vendors, and how a multi agent architecture differs from generative AI added to a SIEM
When not to go agentic: small rule bases, deterministic only regulation, no owner for safety policy

2Module 2 — The agent roster: taxonomy, contracts and model choices

Three tiers: core operational, intelligence and orchestration
The ten to fifteen agent target state versus a five agent production deployment: how to start small
Single page agent contracts: system prompt, tool list, output schema, escalation rules
Small language models versus frontier LLMs: latency, data control, cost and hybrid strategies
Hosting options: commercial cloud regions, private cloud and on premises, and authorised cloud requirements for public sector work
Role specific training data: analyst triage decisions, malware and traffic datasets, STIX TAXII feeds

3Module 3 — Memory and data foundations

Four tier agent memory: working, episodic, semantic and procedural
OCSF to normalise alerts, threat intelligence and vulnerability data
The internal knowledge store: asset inventory, identity and privilege graph, topology, business impact parameters
Privacy and sector data rules that limit what telemetry agents may process and retain
Memory hygiene: provenance, retention and the poisoning risk
Data readiness check: what your SOC must fix before agents can help

4Module 4 — Orchestration patterns and coordination

Hierarchical planner worker, planner decider, handoff and escalation patterns
Event driven messaging over queues such as Apache Kafka
Resolving agent disagreement: majority voting, structured debate and mandatory human escalation
Follow the sun handoffs between human shifts and agent teams
Handoffs that degrade gracefully when part of the chain fails

5Module 5 — The open protocol stack: MCP and A2A

MCP for vertical: schema validated access to SIEM, asset inventory, identity and EDR tools
A2A for horizontal: agent discovery through capability cards, task lifecycle, streaming updates and trace identifiers
Why open Linux Foundation governed protocols outlive frameworks
Agent identity and authorization: workload identity, mutual TLS, least privilege scopes and token based authorization
A2A and SOAR together: agents reason and decide, deterministic playbooks execute the approved step

6Module 6 — Hybrid reasoning and cost aware inference

The AgentSOC framework: perception, counterfactual hypothesis generation, graph based feasibility validation and risk scored action selection
Risk scoring: balancing containment value against business impact with tunable weights
Anomaly gated inference: classical anomaly detection in front of LLM agents to bound cost and latency
Detection engineering at scale: agent drafted rules with test corpora and human spot audit
Cost control: token budgets, caching and routing between small and large models
The metric that matters: time from a new threat class appearing to a deployed detection

7Module 7 — The Reviewer Agent and safety as code

Why safety rules do not belong in prompts, and the role of a privileged reviewer
Policy as code inputs: blast radius, confidence, reversibility and always escalate asset lists
Three terminal states: auto execute, auto reject, or escalate to an analyst with the full reasoning chain
Defence in depth: business risk policy plus platform admission control
Pre execution reviewer and post execution auditor, and who owns the policy

8Module 8 — Adversarial threats and securing the agent estate

Multi hop indirect prompt injection through logs, emails and filenames, and how it can travel across agents
Memory poisoning of episodic and semantic stores
Agents as privileged non human identities: least privilege, privileged access management and immutable audit logs
Protocol and supply chain risks: MCP servers, agent cards, third party agents
Red teaming agents, with OWASP agent security guidance, MITRE ATLAS and NIST AI security publications as references
Controls: input validation at every hop, context isolation and human gates for high impact actions

9Module 9 — Evaluating agents, earning autonomy and running the operating model

Evaluation harness: replaying historical incidents and tracking precision, recall, analyst override rate and escalation rate
The staged autonomy ladder: shadow, recommend, approve, then autonomous within limits
Operating model: 24x7 coverage, analyst retention, and the detection engineer shift from writing rules to curating policy
Board and audit committee reporting: metrics that show value and control
Making the business case: baselines before benchmarks

10Module 10 — Governance, regulation and build buy or MDR

NIST AI RMF and CSF 2.0 mapping; SP 800 53 controls and the agentic AI control overlays now in draft
Disclosure and supervision: SEC cyber incident disclosure and risk governance rules, NYDFS Part 500, and sector regimes
Canada: OSFI Guideline E 23 (effective 1 May 2027) and third party risk expectations, plus federal and Quebec privacy law
EU AI Act exposure for multinationals: classify before you comply, with the 2027 and 2028 high risk timelines from the provisional Digital Omnibus agreement
Audit trails: logging every tool call and agent handoff against a single trace identifier
The vendor landscape: platform vendors and independent AI SOC platforms; a criteria first matrix for build, buy, MDR or blend
Due diligence on vendor claims and fourth party model risk

Team Capstone

Each team designs an agent roster, writes reviewer policy and red team findings, and pitches a 90 day roadmap to a panel that plays the audit committee.

1Use case and value — process, users, value hypothesis, baseline to beat
2Autonomy level — chosen level and why simpler options fall short
3Tools, data, permissions — sources, tools, identities, scopes, logging per action
4Roles and coordination — roles, contracts, pattern, or the case for one agent
5Approvals and escalation — high stakes checkpoints, escalation to a named owner
6Evaluation plan and KPIs — test set, graders; success, escalation and cost KPIs
7Security and cost controls — safeguards, run budgets, step caps
8Limits and deployment plan — limitations, deployment needs, owners, next steps

What Participants Take Home

Agentic SOC playbook templates
Single page agent contract template
Orchestration pattern selection guide
Reviewer policy as code template
Evaluation harness and staged autonomy ladder
Audit trail and evidence pack checklist
Disclosure and materiality metrics checklist

Certificate of Completion

Attendance: completion of all three days, including the final capstone session
Capstone roadmap: 90 day rollout roadmap submitted and presented in the final session
Participation: contribution to team exercises and between session tasks
Self assessment: completed at the start and end, against the outcomes

Upcoming Batch

North America

Eastern Time (ET)

Virtual

To be announced

Language:English

Who Should Attend

CISOs, VPs and Directors of Security Operations
SOC managers, incident commanders and MDR or MSSP service leaders
Detection engineers, SOAR SIEM architects and security architects
GRC, model risk, privacy and AI governance leads, including those who brief audit committees and boards
AI and platform engineers who run the policy and Kubernetes layer agents will sit on

Prerequisites

Intermediate to advanced. Working knowledge of SOC operations is assumed; no machine learning background is required.

Lead AI Practitioner

Every programme in this catalog is delivered by a senior AI practitioner with more than 10 years of experience building and deploying AI in production for organisations across Europe, the UK and Latin America. Their background spans banking, insurance, healthcare, industry, defence and e-commerce, and includes leading AI research and development as a technical director and acting as a lead data scientist on industrial anomaly detection, predictive maintenance and IoT analytics. They are also an academic director and university lecturer in artificial intelligence who trains enterprise teams directly.

Production LLM assistants, chatbots and voice AI agents integrated with enterprise data and workflows
AI agents running at scale, writing thousands of outputs per day for a European e-commerce company
A multi-agent demand-forecasting system for a major airline, used for dynamic pricing
Credit-risk scoring models built and validated for a European bank
Sensor- and sound-based predictive maintenance and computer-vision defect detection for manufacturers

Interested in This Programme?

Contact our team for seat reservations, group bookings and customisation options tailored to your organisation.

$1,499/ person

Book a Slot

Scheduled cohorts open — for individuals or teams · To be announced

Enquire Now Back to Catalog

300+

Companies Trained Globally

98%

Participant Satisfaction Rate

Industries Served

Trusted By

Book a Slot Enquire Now

Programme Overview

This masterclass teaches the Agentic SOC model against that backdrop, with emphasis on standards led governance, defensible audit trails and a clear build, buy or MDR decision.

Why this training is necessary

Static playbooks and linear workflows strain under alert volume, data sprawl and adaptive adversaries, and single LLM chatbots or generative AI bolted onto a SIEM fall short.

Standards led governance and disclosure expectations are moving quickly: NIST CSF 2.0, NIST AI RMF, SP 800 53, the Cyber AI Profile and CAISI agent standards initiative.

Teams need a defensible path to autonomy through reviewer policy, staged autonomy and audit trails that support incident materiality decisions and board reporting.

Learning Outcomes

After attending this programme, participants will be able to:

Shift the SOC operating model from human analysts to agent teams with human on the loop oversight.

Design the agent roster across core operational, intelligence and orchestration tiers with single page agent contracts.

Map memory, data sources and regulatory touchpoints for US, Canadian and EU AI expectations.

Orchestrate multi agent teams over open protocols and resolve disagreement through escalation.

Build reviewer as policy safety, evaluation harnesses and a staged autonomy ladder.

Produce a 90 day Agentic SOC rollout roadmap with governance, audit trails and market aware build buy or MDR decisions.

Team Capstone

Each team designs an agent roster, writes reviewer policy and red team findings, and pitches a 90 day roadmap to a panel that plays the audit committee.

1Use case and value — process, users, value hypothesis, baseline to beat

2Autonomy level — chosen level and why simpler options fall short

3Tools, data, permissions — sources, tools, identities, scopes, logging per action

4Roles and coordination — roles, contracts, pattern, or the case for one agent

5Approvals and escalation — high stakes checkpoints, escalation to a named owner

6Evaluation plan and KPIs — test set, graders; success, escalation and cost KPIs

7Security and cost controls — safeguards, run budgets, step caps

8Limits and deployment plan — limitations, deployment needs, owners, next steps

Certificate of Completion

Attendance: completion of all three days, including the final capstone session

Capstone roadmap: 90 day rollout roadmap submitted and presented in the final session

Participation: contribution to team exercises and between session tasks

Self assessment: completed at the start and end, against the outcomes

Agentic SOC Masterclass — North America

Programme Overview

Why this training is necessary

Learning Outcomes

Programme Outline

Team Capstone

What Participants Take Home