More Than Lights and Lanyards: A Reflection on the Cisco Live! 2025 SOC

Now that more than a week has passed since we closed the doors on Cisco Live 2025, I’ve had some time to truly reflect on the whirlwind experience. The feeling that has solidified the most is one of profound gratitude. Having the honor of co-leading the Security Operations Center (SOC) provided me with a unique perspective, and looking back, it was even more than a conference; it was a chance to see the industry’s best come together to learn, connect, and innovate. 

A Mission We Lived, Not Just Led

We went to San Diego with a clear mission for our team, and I was incredibly proud to see it executed with such passion and precision. 

• Protect: We fulfilled our primary mission to Protect the event through a powerful combination of foresight and agility. Our planned defense was built on a seamless flow of information between integrated tools, including Endace, Splunk, Splunk Attack Analyzer, Duo Central, and Cisco XDR. This architecture was brought to life by the real-time collaboration between our SOC and the on-site product engineering teams. Our shared goal to build automation on the fly was crucial in reducing alert fatigue for our analysts and enabling rapid notification for any compromised attendee. 

Of course, no plan survives first contact with the network. Early in the week, our workflows were unexpectedly overwhelmed by a massive amount of POP3 traffic— a protocol we haven’t seen in such volume in over a decade. Instead of letting this bog the team down with manual investigations, one of our best Splunk analysts immediately got to work. In coordination with the Cisco Live registration team, they built a new, automated workflow to parse the traffic and notify the person if they were a registered attendee. It was a perfect, real-world example of automating a mundane task to keep our analysts focused on more complex threats and threat hunting. 

• Educate: Our mission to Educate was twofold. Publicly, the team’s energy was incredible as they guided attendees through a staggering thirteen SOC tours. But just as importantly, education was an internal focus. One of my most critical roles was to lead and mentor our analysts to think like a threat actor. This mindset is the cornerstone of effective threat hunting—the art of searching for unknown threats that detection tools can’t see because they’re new. It requires cultivating an “innate curiosity,” the ability to see something on the network and say, “that looks weird.” I encouraged our team to trust that instinct, to dig in and peel back the layers to determine if it was a true threat or benign activity. Watching them embrace this mindset was one of the most rewarding parts of my week. 

• Innovate: For me, this is where our team’s brilliance truly shined. Innovation wasn’t just a planned activity; it was a direct response to the evolving threat landscape. At prior conferences like RSAC and Black Hat Asia this year, we saw the rise of sophisticated, AI-driven phishing campaigns using Domain Generating Algorithms (DGAs). In response, our lead SOC engineer went to work right here at the event and created a custom AI Agent specifically to combat this threat. It was a perfect example of using AI to fight AI. This type of real-time, threat-driven innovation is a hallmark of the work we do at every conference we support. 

My Gratitude for our Team on the Frontline 

Looking back, the single greatest source of pride for me was the team itself. For me, true leadership isn’t about directing from afar; it’s about being in the trenches with your people. It was my absolute privilege to do just that—whether that meant diving into the technical details of an incident with them, mentoring them through a complex challenge, or simply providing the support they needed to excel. 

To my co-leaders, Jessica Oppenheimer and Michael Morris, thank you for your incredible partnership in leading this effort. To every SOC analyst who poured their heart and soul into that week: your dedication was the engine behind our success. You handled immense pressure with grace and expertise. We left exhausted, but it was the best kind of tired—the kind that comes from achieving something great together. 

I would also like to thank Freddie, Andy, Scott and the entire NOC team for their collaboration on our efforts, just like in a modern Enterprise collaboration between the SOC and NOC are necessary for success! 

A Final Thank You 

It was bittersweet to see the week come to an end. On behalf of myself and our entire team, I want to extend my deepest gratitude to everyone who stopped by the SOC and shared the experience with us. You were the reason we do what we do! 

That week was a powerful reminder that our industry’s strength lies in its people. I left tired, but I remain inspired and honored to be a part of this community. Until next time. 

Contact us at info@secureyeti.com 

To read more BLOG posts from other members of the Cisco Live 2025 SOC team please visit https://blogs.cisco.com/security/cisco-live-san-diego-2025-soc