Ninja Labz film · 2026-09-25 · live production data
SecOps hand-off: the AI writes the next detection
After the edge block, an on-box SecOps agent closes the incident out: a post-incident report, change requests a human approves, and new detection rules. Claude writes each rule; the SIEM backtests it on 5,000 real events and ships it only if it catches the attacker and stays quiet on normal traffic.
- 16 post-incident reports filed on the first real run
- 7 detection rules made live, none of which existed that morning
- 3 change requests waiting for a human
- Every rule backtested on the last 5,000 real events before it ships
