Cisco Security and Splunk Security released the Findings Report from the Security Operations Center at RSAC 2026 Conference.
This year marked the 10th year of the SOC at RSAC. Since 2017, the mission has stayed consistent: protect the conference network, educate attendees about what happens on an open wireless network, and innovate with new integrations, workflows, and security operations practices.
The 2026 SOC was also an important step toward something bigger. We were not yet operating a fully agentic SOC at RSAC 2026, but the foundation was taking shape: integrated telemetry, automated escalation, full packet evidence, AI-protected workflows, and a closed-loop operating model between Cisco XDR and Splunk Enterprise Security. Those lessons helped inform the Agentic SOC work that followed at Cisco Live Americas 2026.
RSAC is a uniquely valuable environment for learning. The Moscone Center wireless network is open and unsecured, similar to the networks people use every day in hotels, airports, coffee shops, and major events. The SOC does not decrypt encrypted traffic. Instead, the team uses network telemetry, DNS visibility, packet capture, threat intelligence, and integrated security tools to identify risk, investigate suspicious activity, and help attendees better protect themselves.
For RSAC 2026, the team deployed the SOC in a Box architecture, connecting Endace full packet capture, Splunk Enterprise Security, Cisco XDR, Cisco Secure Firewall, Cisco Secure Access, Cisco AI Defense, ThousandEyes, Splunk Attack Analyzer, Cisco Secure Malware Analytics, Cisco Talos intelligence, and partner (alphaMountain, Pulsedive and StealthMole) and community threat intelligence sources.
The full report includes the details, but a few themes stood out.
First, integration changed how the SOC worked. Cisco XDR supported efficient triage and correlation, while Splunk Enterprise Security supported deeper investigation, hunting, enrichment, and reporting. Splunk SOAR helped connect the workflow so that context could move between systems instead of forcing analysts to manually re-enter evidence or switch consoles to understand what happened.
Second, automation reduced toil. Cleartext credentials continued to appear on the network, but the team advanced the response model from standalone scripting to an integrated Splunk SOAR workflow. Detections became formal findings in Splunk Enterprise Security, and the playbook could notify affected users, update the finding, and close the case. That saved more than nine hours of analyst time during the event and created a repeatable model for future conferences.
Third, encrypted traffic remained both a success and a challenge. Encryption helps protect attendee privacy, and the SOC does not decrypt attendee traffic. But defenders still need ways to identify threats. Cisco Secure Firewall’s Encrypted Visibility Engine helped the team find meaningful signals in encrypted sessions without decryption, including activity that supported a malware investigation and response.
Fourth, AI became part of the security story in two ways. The SOC used Cisco AI Defense to gain visibility into generative AI application usage and to help protect on-premises AI models running in the SOC in a Box. At the same time, the team observed that AI demonstrations and agentic applications can introduce risk when they are built or operated without basic secure communication controls.
Finally, the human mission of the SOC remained the same. The report includes examples of accidental data exposure, insecure email, unsecured web applications, misconfigured access paths, exposed storage, phishing infrastructure, scam domains, and malware investigations. In each case, the goal was not only to detect the issue, but to help RSAC and affected attendees understand and reduce the risk.
That is why the full Findings Report matters. It is not just a list of alerts. It is a field report from a live, high-pressure SOC operating in a real conference environment, where technology, process, automation, AI, and human judgment all have to work together.
Download the full RSAC 2026 SOC Findings Report to see the architecture, metrics, investigations, lessons learned, and recommendations from the 10th year of the SOC.
The core advice remains simple: encrypt, encrypt, never trust, and always verify.
Our thanks to the engineers, analysts and partners who made the SOC possible.
Watch the recorded presentation ‘PROTECTED: The 7th Annual Report from the SOC at RSAC’ (RSAC subscription required).
