Detection at Scale · 2026-02-24 · 38 min
What does it actually take to automate security operations when you're processing 7 trillion log lines daily and a single missed threat could compromise billions of users? Michael Sinno , Director of Detection & Response at Google , explains how his team handles this with less than 1% requiring human intervention through strategic AI implementation. He explores Google's methodical approach to AI autonomy, including fine-tuned models trained on golden datasets, validation through overseer agents, and the critical distinction between traditional automation and agentic AI that exercises judgment. Michael also discusses groundbreaking work with Sec-Gemini and Timesketch that enables forensic analysis to surface attack patterns humans would never detect manually. Michael shares concrete metrics like reducing executive incident notifications from 30 minutes to 90 seconds, achieving 95% precision in ticket deduplication, and automating vulnerability coordination from hours to minutes.
Closing The Alert vs. Closing The Loop: How AI Is Reinventing the SOC67 / 100
Block's CISO James Nettesheim on How 40% of Their Detections Are Now Written with AI
Compass' Ryan Glynn on Why LLMs Shouldn't Make Security Decisions - But Should Power Them
Veeva Systems' Mike Vetri on Building Threat Operations Teams and AI-Powered Investigations
Trustpilot's Gary Hunter on Structuring Security Knowledge for AI Success