
Global Field CTO for @Splunk, but opinions here are all me. Founder of @BigDataBeard.
Birmingham, AL
Joined March 2010
- Tweets2.8K
- Following1.6K
- Followers1.7K
- Likes2.8K
My three-question test before an agent acts without a human:
Can you undo it?
Do you know the blast radius?
Is it documented for a new hire?
Three yeses, let it run. Anything less, a human owns the call β
What's new at Splunk π splunk.com/en_us/whats-new.hβ¦
Your agent went rogue. Was it attacked, did it degrade, or did it just obey?
Security, engineering, and design each own a different answer. From the outside they look the same π
Full keynote π youtu.be/t3LJOz9Ysqo
What if you saw the outage 30 minutes before it happened? π
Time series foundation models can forecast every metric on a single GPU. Agents find the cause. Your analyst approves the fix.
No war room. No postmortem.
What's new at Splunk π splunk.com/en_us/whats-new.hβ¦
Self-healing isn't a product. It's an operating model in four moves:
Trusted telemetry. Machine-speed prediction. Agentic investigation. A human makes the call.
Most teams are stuck on move one π‘
What's new at Splunk π splunk.com/en_us/whats-new.hβ¦
An AI agent gave every customer an expired $300 discount.
Not a breach. Not a bug. Not a hallucination.
It did exactly what it was told π¨
Full keynote π youtu.be/t3LJOz9Ysqo
Adding AI agents to your ops team can make it more complex, not less.
Without one trusted system of record, every agent is guessing from partial data.
Hype doesn't scale. Shared context does π§
What's new at Splunk π splunk.com/en_us/whats-new.hβ¦
Your MTTR dashboard is a receipt for downtime you already paid for.
Recovering faster doesn't fix that. Predicting the failure and stopping it does.
The cheapest outage is the one customers never see β±οΈ
What's new at Splunk π splunk.com/en_us/whats-new.hβ¦
.@Cory_Mintonβs story goes well beyond the title on his business card.
BBQ, volunteer work and competitive skiing have all shaped the person behind Splunkβs Global CTO.
Get to know Cory in the latest Million Data Points.
AI isn't here to replace you; it's here to elevate you. The real question for CISOs, CIOs, and CTOs: are you solving high-value problems with it? Watch the full TechTarget webinar: brighttalk.com/webcast/15429β¦
CISOs, CIOs, CTOs: Stop chasing incidents. The future is about prevention and self-healing operations. Build that foundation now. π‘ Watch the full TechTarget webinar: brighttalk.com/webcast/15429β¦
Outages are a boardroom-level risk, costing businesses dearly. The real challenge isn't just preventing downtime, but quantifying its impact and driving strategic investment. Are you prepared to articulate that value? Watch the full TechTarget webinar: brighttalk.com/webcast/15429β¦
CISOs, CIOs, CTOs: Stop reacting to security incidents. Build proactively towards future goals and prevent them entirely. True security is built, not just managed. π‘ Watch the full TechTarget webinar: brighttalk.com/webcast/15429β¦
Price per token is the wrong metric. Cost per accepted task is the right one, because it includes retries and human review. A model that's 80% cheaper and triples failures loses money. Route by step. splunk.com/en_us/blog/artifiβ¦
#Tokenomics
Token prices keep falling. Your AI bill keeps climbing. Not a contradiction, it's volume, and cheap tokens are what make volume invisible. Budget agents by business workflow, not token count. splunk.com/en_us/blog/artifiβ¦
350M parameters. That's the whole model.
Cisco Foundation AI's new open-weight Antares models outperform much larger models at locating known vulnerabilities in unfamiliar code.
Efficiency is becoming a security feature.
blogs.cisco.com/ai/introduciβ¦
Phishing triage isn't a volume problem. It's a pivot problem: four tools per reported email. Automated Threat Analysis is GA in Splunk ES, so the phish hits the analyst queue with the attack chain already run and scored. splunk.com/en_us/blog/securiβ¦
Most teams tier data on one assumption: cheap to store means invisible during an incident. That assumption set your licensing bill. Federated Search is GA across Azure, Databricks, Snowflake and DDSS. community.splunk.com/t5/Prodβ¦
The people who best understand what to automate in your SOC usually can't build it. Splunk Agent Launchpad is GA: no-code agents, built where the alert fired, inside Splunk where admins set boundaries, evidence trace on every run. splunk.com/en_us/blog/artifiβ¦
Catch the full conversation and subscribe to Cybersecurity Explored on YouTube for more on cyber careers, tech, and where the industry is headed. youtu.be/6pmZxhMgOEE?si=rGzN⦠#Cybersecurity #TechHistory #Internet
Catch the full conversation and subscribe to Cybersecurity Explored on YouTube for more on cyber careers, tech, and where the industry is headed. youtu.be/6pmZxhMgOEE?si=rGzN⦠#Cybersecurity #InfoSec #TechHistory
