Tutorials
The role of the tutorials is to provide a platform for a more intensive scientific exchange amongst researchers interested in a particular topic and as a meeting point for the community. Tutorials complement the depth-oriented technical sessions by providing participants with broad overviews of emerging fields. A tutorial can be scheduled for 1.5 or 3 hours.
Tutorial on
AI Incident Responders in the Real World: What It Takes to Make Agentic SecOps Work
Instructor
|
Yash Patel
Microsoft
United States
|
|
|
|
Short Bio
I am an award-winning Cybersecurity Professional and Software Engineer with about 10 years of experience building secure, resilient, and scalable systems that safeguard enterprises and critical infrastructures worldwide. At Microsoft, I have spearheaded high-impact security engineering initiatives across Azure, DevOps, and enterprise security driving innovations in zero-trust frameworks, system observability, automation, and AI-integrated security solutions. My contributions have fortified services relied upon by global customers while elevating industry standards in reliability, compliance, and risk management. Beyond corporate impact, I am deeply committed to advancing the cybersecurity community. As an advisor, trainer, and researcher, I actively contribute to academic publications, global workshops, and non-profit initiatives with multiple global organizations like CyberNGO, Mentors Without Borders, TCET, CHARUSAT, PARUL, MSU, Live2Serve and Many More, promoting cybersecurity awareness and training future leaders. Recognized with honors such as the Global Recognition Award 2025 and multiple CISO50 Innovation & Excellence Awards, my mission is to bridge research, engineering, and leadership to shape the future of digital trust and resilience.
|
Abstract
Enterprise security teams are exploring AI-powered agents to improve incident response, operational readiness, and tabletop exercises, but making agentic SecOps work at scale requires more than a compelling prototype. This session shares lessons from prototyping an SREAgent-style incident responder workflow for cloud infrastructure security engineering. It will examine how agents can assist with triage, evidence gathering, alert context, runbook guidance, and response simulation, while also addressing the hard parts: trust boundaries, permissions, auditability, human approval, workflow ownership, and production safety. The session focuses on practical design patterns, failure modes, and readiness criteria needed to move AI-assisted incident response from experimentation toward reliable, secure, and operationally responsible enterprise adoption.
Keywords
Cloud Security, SecOps Automation, AI for Security Operations, Enterprise Security Engineering
Aims and Learning Objectives
AI-Powered Security Responder
Target Audience
Security Professional at any level
Prerequisite Knowledge of Audience
Cloud Security, SecOps Automation, AI for Security Operations, Enterprise Security Engineering
Detailed Outline
Enterprise security teams are exploring AI-powered agents to improve incident response, operational readiness, and tabletop exercises, but making agentic SecOps work at scale requires more than a compelling prototype. This session shares lessons from prototyping an SREAgent-style incident responder workflow for cloud infrastructure security engineering. It will examine how agents can assist with triage, evidence gathering, alert context, runbook guidance, and response simulation, while also addressing the hard parts: trust boundaries, permissions, auditability, human approval, workflow ownership, and production safety. The session focuses on practical design patterns, failure modes, and readiness criteria needed to move AI-assisted incident response from experimentation toward reliable, secure, and operationally responsible enterprise adoption.