At Cisco Live AMER 2026 in Las Vegas, my work with the Cisco Event SOC centered on one outcome that makes these deployments valuable beyond the event itself: Education. The SOC protects the conference, but it also turns live operations into a learning environment through SOC tours, Cisco Live sessions, training inside the SOC, and conversations in the World of Solutions. Just as important, lessons from the event feed back into product conversations, repeatable workflows, and future deployments.

SOC tours made the mission visible

Attendees saw how the SOC works with the Network Operations Center to monitor real conference traffic, investigate suspicious activity, and protect the conference experience. The tours also showcased One Cisco in action by bringing networking from the NOC together with security and observability. With the release of Cisco Cloud Control, that connection felt especially relevant. The tours gave attendees a practical view of why shared operational context matters, especially when teams need to understand, decide, and respond quickly.

Bringing live SOC lessons into the classroom

Education also happened in the sessions I delivered at Cisco Live. I used three different formats to bring live SOC experience into the room:

• a DevNet session for coding and API based automation,
• a hands-on lab, and
• a technical seminar for a deeper architectural discussion.

The purple team lab was especially valuable because attendees worked through both red team and blue team activity based on real APT group emulation. They could see how agentic AI can shorten the path from detection to remediation, while analysts still validate evidence and make the final call. Across the wider SOC team, analysts were also balancing live operations with speaker sessions, booth conversations in the World of Solutions, and hands-on coaching for newer team members.

Training SOC: building confidence during live operations

Education also happened inside the SOC. We had extra space available during the event and used it as a Training SOC, where newer team members could learn the environment hands-on while live operations continued nearby.

That format gave new SOC members time to understand the event network, the toolchain, and the handoff between the SOC and NOC before jumping fully into live investigations. They could walk through example detections, review evidence with experienced analysts, and ask questions about the context that makes event security different from a steady-state enterprise environment.

Experienced analysts explained how they moved from signal to decision, what evidence changed their confidence, and how they documented the outcome. That helped newer team members build confidence while turning live event experience into repeatable learning for the next deployment.

Education through customer conversations

The World of Solutions added a different kind of education. Booth conversations were less structured than a tour or a class, but often just as useful. Attendees brought questions about alert noise, visibility, automation, handoffs between teams, and how to mature a SOC without adding friction for analysts. Those conversations made the education loop two-way: we shared what we learned from operating the Event SOC, and customers helped us see what needs to be clearer, easier, or more useful in real environments.

Where education feeds innovation

Event SOCs pressure-test technology and process in a way a lab cannot fully recreate. The environment is temporary, noisy, high stakes, and built quickly. That forces the team to see what works, where workflows slow down, and where better integrations or automation can make a difference. The outcome is not only a safer event, but better product feedback and a stronger baseline for the next deployment.

Cisco Live AMER 2026 reinforced that the SOC is one of the best classrooms we have because it teaches through real operations.

For a deeper look at the model behind these deployments, read the Cisco Event SOCs: A Reference Architecture and Operations Guide.

At the next Cisco Live or Cisco-supported event, book a SOC tour. It is one of the best ways to see the Event SOC in action and take practical lessons back to your own SOC.

Check out the blogs by the engineers who worked inside the SOC at Las Vegas:

• Building the Agentic SOC at Cisco Live Americas 2026
• Building an Agentic Tier-2 SOC Analyst at Cisco Live AMER 2026
• The Experience Dividend: How Better Digital Experience Protects Revenue, Trust, and Growth
• Cable to Cloud – A Product Engineer’s Journey Through the Cisco Live AMER 2026 SOC
• What Working the Cisco Live SOC Taught Me About AI, Detection, and Response
• Elevating Expertise in the SOC
• Machine Speed, Human Judgement: How AI Changed the SOC in 2026
• SharpHound Recon Attack – How AI enhanced the threat hunt
• Endace: Using LLMs and Endace Full Packet Capture for Incident Response
• Endace: Never Underestimate Cisco Live!
• Endace: Supporting Encryption vs. Using Encryption: When the best laid plans go astray