Orchestrating the Next Evolution of Detection as Code

Orchestrating the Next Evolution of Detection as Code

by Cloud Security Podcast

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Cloud Security Podcast 👥 39K 📅 April 16, 2026 ⏱ 42 min 👁 14K 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

detection as codeAI agentsalert triagecontextgovernance

Summary

In this episode of the Cloud Security Podcast, host Ashish Rajan interviews Jack Naglieri, CEO of Panther and creator of StreamAlert, about the evolution of detection engineering. Jack outlines three phases: traditional SIEM (Splunk), detection as code (Python-based), and the emerging agentic era. He argues that AI agents will absorb most detection and triage tasks, eliminating alert fatigue and shifting the role of security analysts from manual investigation to orchestrating agents. Key points include the importance of deep organizational context for agent effectiveness, the need for governance to prevent agents from causing harm, and the debate on building vs. buying AI security tools. Jack emphasizes that while agents can handle routine triage, human oversight remains crucial for decision-making and providing context. The conversation also touches on the future of SIEM, the role of data pipelines, and the shift towards prompt engineering as a core skill. The episode concludes with lighthearted personal questions.

152 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information is high for practitioners interested in the practical application of AI in security operations. Jack provides concrete examples of how agents can be used for alert triage, detection tuning, and investigation, and he offers a clear framework for understanding the evolution of detection engineering. The argumentation is solid, grounded in Jack’s extensive experience at Yahoo, Airbnb, and as founder of Panther. He makes a compelling case for the agentic future, but acknowledges challenges such as the need for context and governance. The discussion is balanced, addressing both benefits and risks, and avoids overhyping AI capabilities.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the content is based on expert opinion and industry experience rather than formal research. No specific sources are cited within the episode, and the description provides only links to the podcast’s own website and social media. The title accurately reflects the content, which focuses on the evolution of detection engineering. The discussion is forward-looking and speculative, but it is grounded in practical knowledge. The lack of citations reduces the overall rigor, but the expertise of the guest adds credibility.

199 words

Title / Content Match

The title accurately reflects the core theme of the episode, which focuses on the evolution of detection engineering towards AI agents and orchestration.

Quality & Reliability

7/10

The discussion is grounded in the guest's extensive experience as a practitioner and founder, but it is primarily opinion and forward-looking speculation rather than peer-reviewed research. Claims about AI capabilities and industry trends are plausible but not backed by empirical data or citations.

Chapters

Cited Sources

Concurring Sources

  • Panther Labs — Company website of Jack Naglieri, providing context on their AI-driven security platform.

Contribution & Novelties

The episode provides a unique perspective on the evolution of detection engineering, particularly the shift towards AI agents and the concept of ‘detection as code’ evolving into ‘detection as orchestration’. It offers practical insights into how organizations can leverage agents for alert triage and detection tuning, emphasizing the importance of context and governance. The discussion on the future of SIEM and the role of data pipelines is timely and relevant.

Pour aller plus loin :

  • Detection as Code — Overview of the concept and its evolution.
  • AI agent — General background on AI agents and their capabilities.
  • Prompt engineering — Explanation of the skill that Jack predicts will be central to future detection engineering.

114 words

Radar Profile

The radar profile shows high scores in information quantity and quality, reflecting the depth of the discussion. The technical level is moderate, making it accessible to a broad audience. Reliability is slightly lower due to the lack of formal citations and the speculative nature of some claims.

Reliability 6/10