About this talk
Presented by: Amir Gabrieli, VP Product · Brandon Allen, Head of Cyber Defense · Brian Contos, Field CISO (host)
Between July 9 and July 13, 2026, roughly 1,200 AI agents ran about 17,600 actions against Hugging Face's production infrastructure. Once the swarm read a credential from a Kubernetes secret, the agents held admin on two clusters within one second.
Most cloud detection still runs on a schedule. Logs land in a bucket, a collector sweeps it, and an analyst picks the alert up from a queue. An hour or two to an actionable alert is considered acceptable, and the response comes after that. Against a swarm, you're reading the autopsy.
Mitiga is rebuilding the architecture underneath Helios AIDR as a stream, so that by the end of the year the path from event to response runs in under 3 minutes. Inside that window, the six agents of Helios Fleet detect, enrich, triage, and attach a response action. We think 3 minutes to response should be the new standard.
- Amir Gabrieli walks through the architecture, the agents, and why everything in the SOC is becoming agentic.
- Brandon Allen shows what attackers are doing at machine speed, with real examples.
You'll leave with...
- A definition of MTTR that counts vendor delay, collection, and triage
- Why a 30-second detection that waits 4 hours in a triage queue is a 4-hour detection
- Three questions to ask any vendor about MTTR, including us
