Agentic AI in Production: What Works and What Doesn’t in a Real SOC

The evolution of the SOC is no longer just about increasing automation, but about improving decision-making and prioritising alerts according to actual business risk.

This session presents a real-world use case from Fundació “la Caixa”, whose 24/7 Follow-the-Sun SOC operates across Spain, Thailand and Mexico. Building on existing SIEM/SOAR automation, the organisation is exploring agentic AI capabilities using Devo and Strike AI 48 to support alert triage, enrichment and initial analysis.

The goal is to reduce analysts’ workload, improve response times and ensure more consistent risk-based prioritisation, while keeping human judgement at the centre. Preliminary results show improvements in triage time, analytical consistency and escalation processes. The session will also address key challenges, including agent governance, context quality and the need for human oversight.

Co-presented with Erik Alejos, Security Manager at Fundació “la Caixa”, this session shares practical lessons, benefits and limitations from a real-world implementation, with no commercial focus.