The absent perimeter: Why modern SOCs must defend the cognitive layer

As modern Security Operations Centers (SOCs) automate their operations using AI with autonomous capabilities (agentic AI), attackers are bypassing technical defenses by directly exploiting the minds of authorized users through advanced social engineering techniques. This trend reveals a critical gap in the "Zero Trust" model: while this model validates identities and devices, it fails to detect when a user is acting under psychological manipulation. Cognitive security can no longer be limited to traditional awareness training; it must be integrated as an operational capability within the SOC and the Security Incident Response Team (SIRT). In this session, we will examine how incident response teams can incorporate cognitive defense into their workflows, and why corporate culture and context—just as much as technical telemetry—are crucial for mitigating these types of attacks.