Name: Security Operations at Machine Speed
Uploaded: 2026-02-05T16:16:09.241Z
Duration: 1 h 8 s
Description: Security Operations at Machine Speed

Transcript for "Security Operations at Machine Speed": Hi everyone and welcome. I'm John Miller, team lead product marketing here at Recorded Future and I'm excited to have you join us today. As we kick off 2026, we believe this year will be defined by three fundamental shifts in how organizations defend themselves. First is always on Cyber Defense. Threats don't take nights off, weekends off, or holidays off. They operate twenty four seven at machine speed, and defense that only runs during business hours simply can't keep up. Second is smarter, faster scaled cyber operations. Security teams are being asked to do more of it the same or fewer resources. The only way forward is operations that scale through automation intelligence, not just adding more analysts. And third is intelligence led decisions. In an area where threats move faster than human response time, organizations need systems that don't just alert, they decide and act based on intelligence autonomously. These aren't just incremental improvements. This is a fundamental change in how security operations must function. Here's the exciting part. Autonomous Threat Operations from Recorded Future is now available to help organizations make this transition. With this exciting announcement, we're going to focus on answering a single question during today's event. What do I need to know about Autotum's intelligence in 2026? We're going to answer that with two perspectives. First, I'll be talking to Allie Mellon from Forrester, someone who spends her time analyzing hundreds of security organizations and how they're adapting to this new reality. Allie's gonna share what she's seeing in SOC evolution and what's actually driving these fundamental shifts in 2026. Second, I'll have a deep dive with Adrian Portescu, who's gonna walk us through autonomous threat operations from Record to Future. Adrian will show us how capabilities that were announced in 2025 are now available. Autonomous workflows that embody these shifts, which is always on, scaled operations, and intelligence led action. Let's get started. Let me introduce you to our guest speaker today. Ellie Maun is a Principal Analyst at Forrester Research, where she covers security operations and emerging security technologies. And if you follow the cybersecurity analyst space at all, you know Ellie's work. She's been at the forefront of research of how AI is transforming security operations, the evolution of the SOC, and honestly some of the most forward thinking perspectives on where our industry needs to go. What I really appreciate about Aya's research is it's not just theoretical. She talks to practitioners every day. CSOs, SOC managers, security architects, and understands the real pressures they're facing. Ally, thanks so much for joining us today. Thanks so much for having me. I'm thrilled to be here. So Ally, before we dive into the market landscape, I'd love to hear about what you've been working on recently. What research has been keeping you busy? And what are you hearing from security leaders? Yeah, thanks for asking. It's I'm certainly very busy right now. There's a lot happening, a lot changing in the market. We've seen so much interest on the AI features and tools that are being developed today. And it's really fascinating, because obviously, professionals are very skeptical people, and very skeptical of new tech and everything that's coming. But I found that, especially in the first couple of years with generative AI, they were really excited about it. Now, some of that excitement has died down, in part because some of the features that we saw early on aren't as exciting as we were hoping they would be. But I see that tide changing, and we're really starting to see the major improvements and enhancements with generative AI that we have been hoping for all along. So, that's been a big part of what I've been looking at this year, and will continue to be looking at. In addition to that, and very related, is the data management side of things. At the end of the day, data management strategies for security is an evergreen topic. We always need better data management. And so, helping teams prioritize where to keep their data, especially in this AI era, becomes very important. And then lastly, honestly, very related to AI as well, is detection engineering. When we think about the next year, this is the year to make or break your talent management strategy as we evolve with AI. Talent is incredibly important. How we are adopting AI is fundamentally changing the way that we approach talent management, and making sure that we get that right in security operations especially, is fundamental to making sure that we have a strong security team for the future. So, those three pieces together are some of the most important things that I'm looking at this year. That's a pretty interesting stuff and pretty diverse place of where you're looking. And it really tees up what I want to dig into today, which is this fundamental inflection point in security operations. Let me ask you, like, what's driving this fundamental shift in security operations right now, and why is twenty twenty six the inflection point? Yeah, it's so interesting. I already kind of alluded to this a little bit, but a lot of the AI features that we've seen over the past few years have been disappointing. Like, we all have seen some of the summarization and chatbots that haven't been specific enough to a particular use case. But as I mentioned, we're starting to see some much cooler use cases pop up that are really starting to make a difference within organizations. I mean, to give you an example of this, I've seen an organization where they have actually automated their investigation by building their own AI agents internally. And that's some really difficult work. It's something that most organizations are not capable of doing themselves, but it's a clear sign of just how useful this is going to be once we're able to productize that and move towards that. The other factor here that is incredibly important and that we sometimes forget is that the attackers are using AI just like we are. And in the past, that was to do things like better phishing emails, right? Okay, fine. Better phishing emails is a problem, definitely with the human element in cybersecurity, but it's not as groundbreaking as what we were all thinking. And we're finally starting to see that happen, too. If you think about Anthropics' report on research about a Chinese AVT that was able to use Claude to create agents that worked together, and then, with just a little bit of human intervention, was able to steal information from organizations, that's a clear sign that not only are they experimenting with this capability on the attacker side, but it's also starting to work for them. And the more that they're able to trust the output of these AI agents, the more that we're going to see that automated. Now, this is important because once we get to that point, AI is going to be able to dynamically create things like, sure, your initial access through phishing, your credential stealing, but also, once you're able to do that initial access, it's gonna be able to do things like identify what vulnerabilities are in the environment, create exploits on the fly for those vulnerabilities, move laterally, collect data, all of the things that you'd expect an attacker to do, but previously, they had to do it pretty manually. They weren't given the opportunity to know everything about the environment and be able to make 16 different exploits for all the different things that they might see. It took a little bit more work than that. But with AI, it can be much more dynamic, and that's a fundamental challenge for us as we think about the defensive side, where we have to balance, of course, really prioritizing some of our strategies like Zero Trust and some of our prevention strategies, but also using AI ourselves to be able to keep pace with some of these changes in the market. Yeah, I mentioned keeping pace. It sounds like when the attackers are using AI, it increases their speed and how quickly they're able to get into organizations defenses and wreak havoc. So with attackers using AI and adopting new ways and new technologies, what market pressures now are you seeing and being placed on organizations and forcing them to rethink their security operations model? So what do you think is keeping them up at night now on their side, knowing that attackers are are doing these things? So, unfortunately, the cost of tools is a big one. For anybody who is listening to this, if you are struggling with the cost of your SIM or any other tools in your security stack, you are not alone. And so, we see a lot of teams looking to consolidate wherever possible, and to try to make sure that they're bundling and getting as many discounts as they possibly can. But the bigger thing that keeps them up at night, so to speak, is consistently, to be honest, the struggle to hire and retain talent. It is incredibly difficult to find people who can do the job, and then to keep those people once you have them, because it's much easier to just go and say, Hey, I'm gonna join some tech company instead, and get paid more, and have better hours, and all of that. So, when we think about this often, it's in the context of how are you making sure that you're incentivizing your staff to stick around, and how are you getting them up to speed so that they can make better decisions? Because at the end of the day, it's interesting. We have a lot of people that want to be in this industry. The challenge is that they don't have the skills that most executives want to be hiring for. And so, if you can build a strong talent management program, then you can pick up these people that maybe other teams just aren't willing to, you can get them up to speed faster. And that's one of the keys here. Now, all of this, I have to be honest, is juxtaposed against having really limited resources, having very limited time, and it can be easy to miss some very important attacks because of it. So, it's difficult because, at the end of the day, security teams are in a really tough spot between the cost of the tools that they're using, the expectations on the team for what they're going to be able to accomplish with those tools, And then, to be honest, just the resource requirements to run the tools, let alone to actually be responding to the attacks in the environment. And all of that is put in the background of issues with hiring and retaining talent. Yeah, I think we can all relate to those different pressures. The organizations are feeling those around the world. And so now when we talk about this, and organizations are thinking about, you know, these pressures how I'm going to shift, what I'm going to do, so what are some use cases that are driving these organizations to try different approaches to do something new in 2026? Yeah, we see a lot of organizations making meaningful changes in a couple of areas. So I already mentioned some of the automation of investigation, which can be very important, and triage too. That can save a ton of time. And to be honest, especially on the triage front, there are so many alerts that people deal with that just are repeat alerts that are not very meaningful, that are not the fun part of the job, that just burn people out to have to do them all the time. So those capabilities come in handy there. I will say, and I will caveat all of this with, if you're a security team that hasn't built out their incident response playbooks and doesn't know, doesn't necessarily have a standardized version of what to do in different instances from an IRR standpoint, or just a traditional response standpoint, then you're gonna have a very difficult time adopting a lot of the new technologies that are coming up, both on the automation side and on the AI side. And so, if there's one thing that I can leave you with here, beyond the talent piece, it's make sure that you are writing out your incident response processes, anything that's really specific to your organization, because you also need to be able to feed that to whatever AI you're using, so that it can make better decisions. So that's a really important piece here that I like to highlight. And then the other thing is detection engineering, no matter what size organization you are, can be really helpful to get your team up to speed, make sure that they're managing alerts well, to make sure that you're having the highest quality alerts that you can get, and to make sure you're iteratively improving on alerts and detection rules themselves. And I say this with the caveat that it sounds a little intimidating when you think about detection engineering, because people often associate it with things like detection as code, right? Not every organization is going to be able to do detection as code, and we recognize that. But instead, what we recommend is to take the principles of detection engineering, things like the detection and response development lifecycle, as an example, or moving towards a more agile framework, and implementing those in your SOC or with your security team, such that you can create that cycle of continuous improvement. So, even if you're not going as far as using Terraform to make sure that your detection as code pipeline is strong, you can still get a lot out of detection engineering in a simple way. And then, the last thing that I would be very remiss if I didn't highlight is metrics of success. This is so important both for the security team itself, but also for any tools that you're using or planning on adopting. One One of the biggest challenges we've seen for security organizations when they're choosing to adopt AI is proving to the business the value of the tools that they're using. It's all good. It's all sunshine and rainbows to deploy AI in the organization and start using it. But if you can't prove the value to the company and to the business, then you're gonna have a really hard time keeping that AI capability. And so, having the right metrics around things like need time to investigate, need time to detect, need time to respond, and juxtaposing those against other metrics that help you better understand what is your false positive rate and things like that, that's the sweet spot of helping to give a better perspective on how effective these tools are and how much they're helping support your team. That's perfect. I think it gives our listeners, viewers, a great idea of things they can start this year and the actual things to focus on. So now, as we're ending 2026, from your perspective, I think you have a lot of cool ideas and things that you see. So what are your predictions for the market in cybersecurity and and your outlook for 2026? And what security leaders need to be thinking about? Yeah. I hate to be that person that like every person that comes on to to talks like these and says AI, AI, AI, but I have to be real with you guys. I'm a huge AI skeptic. I always have been technology in general, a skeptic, but AI is, I'm very shocked with how much we're gonna see AI changing the security operations function as a whole. And so, when you're thinking about how you're adopting AI, we recommend approaching it from three dimensions: trust, cost, and utility. Now, utility, pretty reasonable, right? Is this feature useful to me or not? You guys can make that determination. I also, of course, have many opinions on this and many thoughts on this that I can share with you. But the second piece, cost. We tend to see that these tools are either directly integrated, or there's some type of consumption based model that teams are using to pay for them. Trust is the really nuanced and difficult one, and this is the area where you should be spending most of your time, which is, can you trust that the AI output that you're being given is accurate and accurate for the business use case? Not just accurate in general, because we've seen there are a lot of responses from AI that are good in general. It is a correct response, but a correct response is not the same thing as a correct response for your business. And so, to make that distinction and identify that difference is really, really fundamental here. And as a part of that, it's about, unfortunately, digging under the hood a little bit and getting to understand how are the vendors that you're working with from an AI standpoint approaching testing and validation of the AI capabilities that they're building? Because that's fundamental to this trust piece. You need to know how they're getting to the answer that they are, how they know that that's the right answer, and how repeatable that answer is. And then, on the other side of this, look for explainability. So, anytime that you're using one of these tools, it should be giving you an explanation of how it got to the answer that it did. That is really important, because ultimately, we're dealing with non deterministic systems here. Your team needs to understand and be prepared to evaluate what the AI has done, so that you can make sure that you're making informed decisions, and that it is the right decision for your organization. So, keep those three things in mind: trust, utility, and cost. And get excited. We're doing some cool things here. That's perfect. Thank you for your insights on all this, and sharing with our viewers what they need to be thinking about 2020 I think the message here is pretty clear that this year is going to be different than last year given AI and the speed that attacks coming and we need to defend. But it's going be an exciting year for what's available and what people can do for their organization and to defend what matters most to them. So, Ellie, thank you so much for your time and your insights. We appreciate you being on and spending the time with us. Thank you so much for having me. All right. So that was a great conversation about the market landscape and what we're all going to experience moving on to this year. The takeaways are pretty clear that security leaders need to use Threat Intelligence in different ways and a whole new speed to operationalize Threat Intelligence to protect this new environment. Now I want to introduce you to someone who's been at the forefront of solving these challenges. Adrian Portescu is our AVP of Product Management of Cyber Operations and Integrations and he's been leading the development of what we're calling Autonomous Threat Operations. Adrian, thanks for joining us today. Thanks John. Glad to be here. Adrian, from everything Ali just shared, it's clear the old playbook just isn't working anymore. But before we dive into solutions, can you paint a picture of what you're seeing from security teams today? What are the challenges they're facing in their threat intelligence and their current setups? Absolutely John. So what we're seeing across security teams really comes down to three fundamental challenges. The first one is that manual work in cyber operations is creating real and dangerous gaps. Security teams are basically constrained by how manual their workflows still are. While attackers are operating at machine speed using automation tooling and even AI to move faster and scale their attacks, defenders are still spending a lot of time clicking through dashboards, maybe copy pasting indicators, manually transforming intelligence, and manually building and updating detections and response rules. Now, that gap in speed is not sustainable. It slows teams down at the exact moment when speed matters most. It introduces human error into critical workflows, and it leaves blind spots that attackers are very good at taking advantage of. At this point, this is no longer just about efficiency or analyst fatigue. It is a clear operational imbalance and for many teams it has become a real operational crisis. Now, that's the first one. The second issue is that security stacks have simply become too complex. The reality is that most security teams today are operating maybe, you know, 15 to 30 different security tools. And in larger environments, that number can even go higher. Each one of these has its own interface, has its own data model, it has tuning requirements, and of course, you know, the usual operational overhead. Now, every one of these tools needs to be maintained, integrated and continuously fed with relevant threat intelligence to stay effective. But in reality, teams simply don't have the capacity to operate every tool at its full potential all the time. What that creates are operational gaps. Tools that are not fully integrated, not properly tuned, or not consistently monitored create blind spots in prevention, detection and incident response. And those blind spots are what attackers exploit all the time. So the risk is not the tools themselves. The risk is the operational complexity that prevents teams from using those tools as effectively as they need to. The third one is the fact that intelligence silos are limiting effectiveness. The reality of the moment is that organizations have more threat intelligence than ever before. They are pulling in feeds from vendors. They might be doing industry groups like Isaacs and their own internal sources. But all of that intelligence is still largely disconnected. Analysts end up spending a huge amount of time manually normalizing, aggregating and trying to correlate these different sources instead of actually taking action. The reality is that no human can keep up with the volume and the velocity of today's threat intelligence. When intelligence is fragmented and processed manually, critical relationships get missed, signal gets delayed, and threats really slip through the cracks. So even though organizations are investing heavily in threat intelligence, they're not getting the full operational value from it. That's a pretty stark picture. So if I'm a security leader now listening to this, what do I need to start doing differently? I think that's actually the right question Akhir. And I agree. While the picture is pretty stark, I think the answer is pretty clear here. Security teams nowadays need to be able to do a few things differently. First, they need to ingest and fully integrate high quality, prioritized threat intelligence that is truly relevant to the organization. And this relevance to the organization is what Eli was talking earlier as well, like intelligence that is continuously validated, produces minimal false positives and removes as much manual triage as possible. That means combining the best external intelligence available with your own internal sources and with your own operational experience. What you prevent, what you detect, what you hunt, what you respond to, all generates intelligence. And the key is closing the loop by feeding it back in continuously and refining priorities and decisions. Second, teams need to operate in truly intelligent way across all functions and activities, prevention, detection and threat hunting. Intelligence has to be shifted left in the stack, not bolted on at the end really. So that means, for example, that hunting across the entire security stack at scale, not just in one tool or one environment. Because as we've discussed earlier, the gap usually forms in the places that we are not actively watching. Third piece is that teams need to enable autonomy so they can operate at machine speed. And the thing is that autonomy doesn't really come for free. It has to be earned. And it has to be earned in a similar way, like, you know, as the SOX and the threat intelligence teams had to earn trust over time. This is the same way that autonomous systems need to earn trust by delivering provable outcomes. Consistent threat prevention, measurable risk reduction and minimal impact to the business would be some of those outcomes that they need to prove themselves through. So when you can demonstrate these outcomes, autonomy stops feeling risky and starts being starts feeling necessary. Absolutely. Now you and your team have been working on a different way for security leaders to actually do this. Tell me more about autonomous load operations and how it works and how it's enabling autonomous intelligence. Before we go into the details, let me actually start with a quick primer for anyone who may not have been following closely since we announced this at Predict twenty twenty five. Autonomous threat operation is our answer to moving security operations from reactive and manual to proactive and autonomous. At its core, it is a system that continuously ingests threat intelligence from multiple sources, correlates that intelligence across your entire security stack, and then takes action. That includes hunting for threats, preventing attacks, and monitoring continuously without requiring a human to manually drive every step. It also measures and reports the impact of that intelligence and the intelligence led controls across the entire organization. The keyword here is autonomous. And this is not really just the traditional automation where you are simply speeding up manual tasks or hard coding workflows. The system is making intelligence driven decisions about what to hunt for, where to look and what actions to take based on the evolving threat landscape, but also the specifics of the environment. And with that context, let me zoom in in some of these new capabilities and how they work in practice. The first one that I want to go into the details is autonomous threat hunting. At a high level, this is about building a system that can hunt for threats, support prevention and implement continuous monitoring on its own. The thing is that traditional threat hunting today is incredibly manual. And this is a reality that we're seeing with our customers. An analyst gets a new indicator, maybe an IP or a domain or more than one associated with a threat actor, for example, that is trending right now. From there, they have to go tool by tool, manually searching for log, checking firewall data, querying EDR platforms and so on and so forth. Now, if they are hunting across 10 different tools, that's 10 different and separate manual workflows. And by the time they're actually finished, the threat might have already moved on. They move at the speed of like, you know, machine speed. So that also might be that once they're finished, they may realize that the indicator was never actually relevant to their environment in the first place or that the threat was not relevant to their organization. Now, with autonomous threat hunting, what we do is that we try to flip that model. The system ingests new threat intelligence, determines what's relevant for your organization and immediately begins hunting across all connected security tools at the same time. It looks for signals, corroids activities, identifies potential signals of compromise without waiting for an analyst to actually manually trigger that hunt. The thing that makes it truly autonomous is that the system decides when to hunt, what to hunt for, and where to look, based on the evolving threat landscape and the context of the environment in the organization. The analysts are no longer responsible for constantly initiating hunts or stitching data together across different tools. Intelligence about threat actors, including their behaviors, informs these decisions. But the execution actually happens automatically. Now, just as important, the system reports on what it finds in a way that aligns with your priorities. Findings are mapped back to the threat actors, the malware families, and even the priority intelligence requirements that are defined and mattered most to your organization. That reporting helps teams understand not just what was found, but where defenses are working well and where they might be gaps that need attention. What used to take hours or days of analyst efforts now happens in seconds or minutes. And it also happens continuously, 20 fourseven, not just when someone has time to actually do a manual run of the hunt. So if I get this right, instead of an analyst manually checking each tool to run the hunt, the system can do it autonomously across everything simultaneously and continuously. A huge operational shift. Exactly. And the thing is that it also scales in a way that manual operations simply cannot. Okay, so you mentioned the entire security stack and scaling. So I think there's a lot there that organizations struggle with. They have all these tools, the thirtyforty, and they're not working together. So how does Autonomous Threat Operations handle that integration challenge? Well, John, this is a critical point, and you're absolutely right. This is where many organizations struggle. When we built Autonomous Threat Operations, we built it in a way to deeply integrate with the security tools organizations already using. This is about operationalizing threat intelligence well beyond the classical SIEM and across the rest of the security stack. That includes EDR and XDR platforms, firewalls, cloud security tools, email security and the controls that really make up your defensive infrastructure, right? What makes these integrations powerful is that they're also bidirectional. We're not just pulling and pushing intelligence into a tool. We're also pulling results back, correlating findings and providing advanced visibility across the entire stack at the same time. I want to say that this bidirectional flow is foundational. If you can't both act across the security stack and also understand the impact and outcomes of intelligence, you can't really end up operating autonomously. So, for example, when new intelligence comes in about an active ransomware campaign, there is relevant organization, whether based on the industry, geography, maybe security stack, autonomous threat operations can automatically begin hunting across the stack in parallel. It can hunt for relevant indicators, but also behavior rules across endpoints through EDR, examine network activity and firewall logs, search cloud telemetry for related signals, and scan email security for associated phishing attacks. A critical part of making this work is translation and validation. Behavior rules and detections need to be translated into the native language of each one of these platforms, but also validated before they're being executed. Right. We're talking about, you know, validation of syntax, validation of logic. Without these steps, autonomy at scale simply isn't possible. And here's a key point. Analysts do not need any more to be experts in every one of these tools to be able to get value. The system handles the technical complexity of querying each one of the platforms, normalizing the data and surfacing the findings that actually matter. These integrations also unlock a much more meaningful layer of reporting from a control perspective, because we can see how intelligence is applied across the stack and what the outcomes are, teams can understand now which controls are performing best, where there are coverage gaps, and where security investment is actually paying off. So that takes reporting beyond tracking threat activity and into measuring the real impact and value of threat intelligence across the entire organization. Okay, so I can see now how this ties back to what you brought up earlier, where the problem of the security stacks complexities actually become the vulnerability on their own when you're not able to effectively monitor everything. Exactly. The integration layer is what enables autonomous operation at scale at scale across the entire environment. Gotcha. So let's talk about the third piece: bringing in multiple intelligence sources. Why is that so important for threat intelligence to make it relevant to that specific organization? Now, is where we're seeing a major evolution in how organizations think about threat intelligence. For a long time, the model was fairly simple. You subscribed to one or more threat intelligence feeds, you ingested a large volume of indicators and hoped that something useful would surface. But in reality, every organization faces a different threat landscape, because they're part of a different industry, different geography, they have different third parties, fourth parties, and they really have a different overall risk profile. Now, with autonomous threat operations, we've shifted away from a one size fits all model. Organizations can leverage Recorded Future Intelligence alongside their own internal and external sources and tailor that intelligence to what actually matters for the environment. That includes industry specific sources like Isaac feeds that are highly relevant to the sector, custom sources from trusted partners or internal research team, regional intelligence types where they operate and proprietary intelligence, of course, generated from their own incidents and investigations. The systems brings all of these sources together, correlates and also prioritizes them and then operationalizes that intelligence autonomously across the entire security stack. The focus is really not ingesting more data, but continuously identifying what is relevant and actionable for that organization. So if you're a financial service organisation, you're combining FS Isaac with Recorded Future Banking focused threat intelligence and then automatically hunting for these threats across the environment. If you're healthcare, you're leveraging H Isaac alongside with healthcare specific intelligence from a quality future without having to manually stitch any of these together. So the result is intelligence that is tailored to the organization, continuously updated and directly tied to action, not just awareness about threats. Yeah, so instead of intelligence being a one size fits all approach for each organization, it's now contextually relevant to each one of those organizations, given their specific threat landscape. Yes, exactly. That context is what makes autonomous threat operations effective. The system isn't acting on generic indicators. It's acting on intelligence that contains indicators and behavior rules contextualized with threats that reflect the actual threat landscape of the organization. This has been incredibly helpful. Thank you, Adrian. You've walked us through how autonomous threat operations addresses those fundamental challenges that organizations are facing Moving from manual to autonomous hunting, integrating across the security stack and making intelligence contextually relevant with multi source capabilities. Thanks for breaking this down. Thank you, John. This is really what enables organizations to operate differently. It's the shift security teams needs to make in order to defend at machine speed like the threats are operating. Agreed. And with that, we actually now have a quick video of autonomous threat operations. Threat actors launch thousands of attacks per second and 600,000,000 attacks per day. Threats now move at machine speed, and your security teams need machine speed defense. Autonomous Threat Operations can help you operate at the pace and scale of these adversaries, giving you twenty four seven threat hunting to hunt high priority targets so you can force multiply your team and accelerate time to action. Autonomous Threat Operations correlates feeds from your sources into recorded future, then automates round the clock threat hunting with minimal supervision. Operationalize your threat intelligence with multi source ingestion, which breaks down intelligence silos. Autonomous threat hunting, which enables continual hunting even as you sleep. Unified prevention and detection, which integrates with your security tools so they're continuously updated with the latest IOCs and hunting packages. Autonomous Threat Operations helps you transform noise into clarity. Clarity into speed. Speed into action. Making sure your team is always on, always defending, always one step ahead. Well everyone that brings us to the end of today's session and I want to thank you all and also thank both Allie and Adrian for joining us. Now if there's one thing I hope everyone takes away from this, it's this: the shift to autonomous intelligence really isn't optional anymore. The threat landscape is moving at machine speed and defenses need to operate at the same speed. The good news is that the technology to make the shift is here now. From all of us at Recorded Future, we are thrilled to have autonomous threat operations available and more importantly we're here to help you on this journey. Now there's several different ways to get started on your path to autonomous threat operations and the Autonomous Intelligence future. First take our Threat Intelligence Maturity Assessment. It's a quick five minute quiz that'll help you understand where you are today on your path to autonomous intelligence. Are you still in the foundational mode with manual processes? Or are you ready to take the leap to autonomous operations? The assessment will give you a clear picture of your current state and what steps to take next. Second, download our ebook on autonomous threat hunting. This guide breaks down exactly how you can swap out those manual steps that are slowing you down with autonomous actions that happen continuously and at scale. It's a practical roadmap for this transformation. And third, explore resources on autonomous threat operations on recordedfuture.com. All these resources will be available to you after the event, so take advantage of them. And of course, if you want to have a deeper conversation about your specific environment and how autonomous threat operations can help, our team is ready to talk. The era of autonomous intelligence is here. And the question isn't whether to make the shift, it's how quickly you can get there. And we're here to help you along every step of the way. Thank you for watching and we'll see you next time.