Pit Stops and Packet Captures at Splunk .conf26

October 14, 2026

I’ve been to enough conferences to have built some ground rules for them. The talks and workshops are why you register, and the people are why you come back. Splunk .conf26 in Denver delivered on both, which is rarer than it should be. I left with a full brain, tired feet, and the kind of energy you only get from a week of real conversations with people who still love this work.

The best part started before the keynote. I got to see friends and family in the hallways and on the show floor, some of whom I only get to hug in person once a year or so. The lobbycon track is still one of the most underrated experiences at any conference (and there is never enough time to see everyone).

The booth was busy from open to close, and the foot traffic brought the good kind of conversations about detection gaps people are tired of living with, how to support disconnected and air-gapped environments, and of course, plenty of talk about AI in the SOC. Then there was the F1 racing simulator, which did not have a quiet minute all week. I have a theory that a racing sim is the most honest tabletop exercise ever built. Everyone overestimates their skill, underestimates the corners, and blames the telemetry when they hit the wall. If it were Mario Kart I would have stood a better chance, but folks had a great time and the competition was fierce.

The keynote, “The Platform for Your Agentic Enterprise,” set the tone for everything that followed. Unified security and observability data, cross-domain context at scale, and trust in AI built on end-to-end visibility. What I took away was that agentic AI is a data problem wearing a new nametag. An agent is only as smart as the data you let it see, and only as safe as the data you can see about it. Not seeing any issues isn’t the same as there not being issues.

That idea ran straight through the three AI security sessions I sat in. “From Prompt Injection to Rogue Agents” walked through the attack surface of LLM (large language model) workloads, RAG (retrieval-augmented generation) pipelines, and MCP (Model Context Protocol) connected tools, and showed how discovery, red teaming, and guardrails mapped to OWASP and MITRE can feed correlated AI telemetry into Splunk Enterprise Security. “The Ghost in the Machine” took it hands-on, hunting prompt injection, tool-call manipulation, and AI-created command execution with UEBA (user and entity behavior analytics), RBA (risk-based alerting), and MITRE ATLAS playbooks. “When the Agent Becomes the Insider” asked the question I keep coming back to. What does normal look like for something that never sleeps and never takes PTO? My takeaway is we spent twenty years trying (sometimes succeeding) to baseline our networks and users. Now we get to try to baseline agents, separating harmless weirdness and misconfiguration from weirdness that is actively hostile. If you cannot tell the agent from the insider, you do not have an AI problem. You have a visibility problem.

On the detection engineering side, the two-hour workshop “The Detection Engineer’s Guide to the AI/ML Universe” was possibly the most practical time I spent all week. Picking the technique, engineering the features, choosing the algorithm, and measuring whether the detection actually works is the part too many teams skip (not casting the first stone, as I have been guilty of this myself). Machine learning will not rescue a detection you cannot measure. It just gets you confident garbage, at speed.

The hunting sessions I attended were great and were another reminder that there is a lot of capability in the tools we already have deployed. “Threat Hunting Salt Typhoon with Cisco Network Telemetry in Splunk” showed that sophisticated adversaries can live on network infrastructure where endpoint tools see very little, and that the firewall and network telemetry many of us already own is an underused sensor. “The Enemy Within” tackled living-off-the-land attacks, where adversaries, in the speakers’ words, “don’t just hide, they belong.” Great threat hunting is not about heroics. It is building a process or framework that you can hand off to the next analyst when it is time to take your cape off and go home.

Which brings me to my favorite part of the week, the Boss of the SOC (BOTS) event. I love the competition and seeing how different teams solve problems and find the answers. Afterwards the “Boss of the SOC at Scale” session shared what thousands of analysts working realistic BOTS investigations reveal about where detection and investigation consistently break down, and how to use the data you have to build out more effective investigations and validate your detections. “Building Skills with AI to Beat BOTS” caught my attention because BOTS has humbled me more than once or twice. It was a good introduction to integrating assistive AI into your security processes versus thinking that AI would take over all of your security processes. Tools are downstream of people, and it was good to see a session built around that.

A big thank you to all of the speakers who shared their hard-won lessons, the crew who worked the booth, and everyone who stopped by to talk shop or take a lap. I can’t wait to see everyone at our next event. Time to get some F1 and BOTS practice in so I can place higher next time.

Follow Optiv + ClearShark
LinkedIn: www.linkedin.com/company/clearshark
YouTube: www.youtube.com/c/OptivInc