Splunk .conf26 ran September 14–17 at the Colorado Convention Center in Denver, and AI was everywhere. The bigger story was how practitioners are actually using it, governing it, and paying for it.
Four of our team members spoke this year, and several more spent the week in sessions, on the show floor, and in the hallway conversations where people stop talking about what they're supposed to be doing and start talking about what they're actually doing. This recap pulls together what our President, our engineers, and our speakers brought home.
Our team on the .conf26 stage
Three Hurricane Labs sessions made the agenda this year:
Session | Speakers |
|---|---|
Building a Multi-Tenant Splunk MCP: Safety Patterns for AI Agents at MSSP Scale | Trevor Mock, Security Operations Architect |
From Raw Data to Deployed Detections in 20 Minutes: Three Architecture Patterns for the Agentic SOC | Trevor Mock, Security Operations Architect, and Jessi Clark, Lead Platform Engineer |
Why Wait for an Incident When You Can Cause One Yourself? Purple Teaming with Atomic Red Team, Splunk, and Enterprise Security | Meredith Kopchak, Director of Technical Services, and Tom Kopchak, Director of Technical Operations |
The question our speakers heard most was some version of "How is Hurricane Labs using AI?" Trevor got a sharper variant after his talks: is what he built available publicly, and how could attendees build something similar in their own environments.
Meredith came away thinking about her purple teaming session in a new light. Attackers are using AI to move faster, and defenders are answering with agentic SOC tooling and better monitoring. That raised a question she kept coming back to all week: in the age of AI, who watches the watcher?
AI is everywhere, and humans aren't going anywhere
Every vendor had an agent. Every keynote had an automation story. Yet in conversations with practitioners, executives, and engineers inside Cisco and Splunk, one point came up with remarkable consistency: we still need humans in the loop.
That isn't a knock on AI. It's getting very good at the work security teams shouldn't be spending their limited time on. High-fidelity, low-severity alerts are a good fit. So are repetitive investigations with predictable outcomes, and the hundreds of low-value alerts that send an analyst through the same steps every time.
"Don't start your AI conversation with, 'How many people can this replace?' Start with, 'How much low-value work can this remove from my people?'" — Joshua Silvestro, President
If AI absorbs a meaningful share of Tier 1 work, analysts get more of their day back for Tier 2 and Tier 3 investigations, threat hunting, engineering, and the ambiguous calls where context and judgment matter. The goal is to remove the work that keeps analysts from being analysts.
Our engineers drew the same line from the practitioner side. Jessi Clark's advice for any Splunk admin: AI governance is key, and no tool should write anything without a human approving it first.
The adoption gap is smaller than it looks, and the bill is getting attention
Publicly, enterprise AI still comes wrapped in hesitation: privacy, data exposure, hallucinations, compliance. Those concerns are legitimate. In more relaxed settings, though, the sentiment shifted to something closer to "we're already using it, and now we need a better way to use it."
That shows up as sharper questions for vendors. What data does the model see? Where does it go? Which model is it, how is data retained, and what happens when it gets something wrong? That's healthy skepticism. The executive question for 2026 is whether you'll understand and govern AI use, or let adoption happen around you.
Trevor Mock's biggest lesson fits here too. There's no single correct way to implement AI. The right approach depends on your data, your team, your risk tolerance, and your workflows, which is exactly why governance has to come first.
The other recurring topic was tokens. As usage grows, organizations are setting token budgets, reviewing consumption, and routing simple tasks to smaller, cheaper models while saving larger ones for harder reasoning. Splunk and Cisco also talked about running AI alongside enterprise data instead of shipping it to a public service, including options like Cisco AI PODs for keeping sensitive security workloads on premises.
Take that one step further and you get desk-side AI compute: a capable local system running dedicated models next to you, with cloud models on call when a task needs more. We're not there yet, but the direction points to an orchestration layer that picks the right model, local or cloud, for each job.
Centralize control, not data
For years the pitch has been consolidation: one platform, one ecosystem, one place for everything. Practitioners at .conf26 were more cautious. Their data lives across SaaS, endpoints, network gear, cloud, data lakes, and SIEMs, and none of it is going away. If one ecosystem has a 24-hour outage, they don't want to lose visibility into everything underneath it.
Splunk's continued investment in federated search reflects that thinking: search the data where it already lives, rather than moving it all before it becomes useful. In Josh's words, centralization doesn't have to mean ownership. It can mean control.
AI is becoming the control plane
This was Josh's biggest takeaway. For the last few years, AI has been added inside each tool: the SIEM, the EDR, the firewall, the ticketing system. Eventually everything gets its own chatbot. The direction now is the reverse: an AI layer that reaches out to the tools.
Cisco Cloud Control offers an early look. Natural-language interaction with infrastructure gets far more useful when it isn't confined to one product. The AI layer understands the request, finds where the information lives, works with the right systems, and eventually takes authorized action.
That could change how organizations think about expertise. Some platform-specific knowledge can live in the AI layer, so internal teams and security providers can work across specialized tools without everyone being an expert in every interface. Humans stay responsible for judgment and oversight. AI handles more of the translation, navigation, correlation, and execution underneath.
Beyond the AI headlines
Not every takeaway was about models and agents.
Observability got a bigger spotlight than expected. Jessi was surprised by the focus on Observability, including the announcement of a free edition of Splunk Observability Cloud.
Exposure Analytics for asset and identity hygiene. Jessi's most useful lesson was using Exposure Analytics to keep Assets and Identities in Enterprise Security current, a chore that rarely gets the attention it needs. They also flagged new tooling in development to help MSPs and MSSPs monitor cloud environments.
Skeptics are finding real uses. Tom Kopchak came in skeptical of AI's usefulness. Hearing other Splunk enthusiasts describe how they save time with it gave him new ideas to try.
A keynote moment worth repeating. Tom's favorite part of the week was Intel CEO Lip-Bu Tan's keynote, where he credited staying humble and asking for help as strategies that served him throughout his career.
If you couldn't make it to Denver
We asked our team what they'd tell someone who missed .conf26:
Watch the recordings. Tom's advice is simple: once the session recordings are posted, catch the ones you missed.
Put governance before automation. Jessi's rule is that no AI tool writes anything to your environment without human approval first.
Use AI to cut operational overhead, with humans validating the results. Trevor's point is that attackers are already using AI to move faster. Defenders who let AI handle the repetitive work, and keep analysts on the decisions, will keep pace.
The questions to take back to your team
If we had to compress the week into one line, it would be this: AI is moving from feature to infrastructure. That changes what leaders should be asking:
Where can AI remove low-value work from our people today?
Which decisions still require human judgment?
How are we controlling AI consumption and model costs?
Where does our data need to live, and which workloads could eventually run locally?
Are we building another set of AI-enabled silos, or an AI layer that works across the tools we already own?
The organizations that answer these well won't be the ones with the most AI. They'll be the ones that know where humans add value, where AI adds value, and how the two work together.
Want to talk through how this applies to your environment? Request a SOC Health Check and we'll look at your search coverage, data quality, and where AI-assisted, human-validated workflows can take work off your team's plate.
