Ten Years in the SOC at RSAC: What We Learned in 2026
Cisco, Wednesday, July 1st, 2026
Cisco marks a decade running the RSAC Security Operations Center, sharing 2026 threat and automation findings.
This post from Cisco's security team marks a decade of operating a Security Operations Center at the RSA Conference. The 2026 SOC combined multiple Cisco and Splunk security tools to monitor an open, unsecured wireless network mirroring real-world public hotspots.
Key results included using automation to reduce analyst workload by over nine hours, detecting threats without decrypting attendee traffic via the Encrypted Visibility Engine, and incorporating AI visibility tools.
While a fully agentic SOC was not yet operational, foundational elements like automated escalation and closed-loop operations were emerging. The core message remains to encrypt everything, never trust, and always verify.