About
John Stauffacher is a cybersecurity executive, incident commander, and published security author who has spent his career building security programs that survive contact with reality. He has led teams through live incidents, noisy telemetry, broken processes, executive pressure, legal constraints, incomplete data, and adversaries who do not care about anyone’s roadmap. His work sits in the uncomfortable space where technical truth, business risk, and operational chaos collide. John is known for cutting through security theater and focusing on what actually holds up under pressure: strong operators, useful intelligence, clear decisions, disciplined response, and systems that keep working when the environment gets hostile.
Sessions
Your SOC Has an AI Problem. It Just Doesn't Know It Yet.
What you will learn:
Artificial Intelligence is going to revolutionize the Security Operations Center. At least, that's what every vendor pitch deck, conference keynote, and suspiciously enthusiastic LinkedIn post keeps telling us. But what happens when the marketing stops and AI has to survive inside an actual enterprise SOC? In this session, we're cutting through the hype and examining what happens when AI meets the messy reality of security operations: incomplete telemetry, noisy detections, complex environments, overwhelmed analysts, and attackers who don't follow the script. Using real-world enterprise examples, we'll explore where AI genuinely delivers value, from accelerating investigations and enriching threat intelligence to improving detection engineering, automating repetitive workflows, and helping analysts make sense of mountains of data. Then we'll examine where it falls apart. We'll dig into hallucinations, misplaced confidence, missing context, unreliable conclusions, and the very real risks of allowing probabilistic systems to make decisions in environments where being confidently wrong can have serious consequences. More importantly, we'll discuss how to distinguish practical AI capabilities from expensive demonstrations, how to measure whether these tools are actually improving security outcomes, and where human judgment remains nonnegotiable. This isn't another presentation about how AI will replace your SOC analysts. It's a practical examination of what happens when you put AI to work alongside them. No magic. No vendor fairy tales. Just what works, what breaks, and what we've learned along the way.