Black Hat 2025 was the moment AI agents in the SOC stopped being a question. This year, the people running those organizations now have to determine what is real, and what is a long-term solution for their teams. After all, no security leader wants to be replacing their SOC infrastructure every year. As Blackstone's Adam Fletcher would put it later that week, it's too disruptive. The choice has to be right. We saw this moment coming. We heard it from security leaders in the community. They feel the urgency and the need to fight fire with fire. Their teams were already run thin, and now that AI is a proven tool, they are reorganizing their approach to security operations. But is an AI SOC the right answer?
As we were preparing for Black Hat, we talked about what we were building in product and how that fits what security leaders actually need. They don't just need an AI SOC. They don't just need an AI bolt-on solution. They don't just need a faster MDR. They need a full end-to-end security platform. They need foundational AI Security. Our product and engineering teams told us that we were ready to launch the Federated SIEM, and we know this was the perfect moment to name 7AI as the foundational AI security platform.
7AI isn't only an AI SOC. It's the foundation underneath one; the layer that sits below the security stack, the way a foundation model sits underneath ChatGPT or Claude. Data creates context. Intelligence creates judgment. Action creates outcomes. In practice, that's production-grade AI agents that detect, investigate, respond, and hunt, grounded in your own environment, with humans always on the loop.
So, this year, we didn't just describe this idea. We showed it live in production. It was displayed on the biggest screen in the world, on the show floor, and on stage with Adam Fletcher, Blackstone's CSO, and our CEO Lior Div.
The foundation had to be real first
A category name is just marketing until there's something real underneath it. So in the weeks before Black Hat, we launched 7AI Federated SIEM and 7AI Build.
Federated SIEM is the piece that makes foundational real. Instead of asking teams to rip anything out or pull all their data into one place, it connects the sources you already have and lets you decide where your data lives. Everything is normalized to a common schema, and you can ask a single question in plain language and get an answer from every source at once. That's what lets our agents detect, investigate, respond, and hunt grounded in your own environment, no migration required.
With that in place, we'd earned the right to call 7AI what it is: the foundational AI security platform. So we went to Vegas to say it.
Taking AI Security to new heights
We had a hard problem. Every vendor at Black Hat was going to say "AI SOC." If foundational AI security was going to mean anything, we couldn't just say it louder than everyone else on the floor. We had to rise above the noise. So we did, literally. Taking over the Sphere wasn't about being the biggest thing in Vegas. It was about giving security leaders one clear signal in a week full of them: there's a real difference between an AI SOC and the foundation underneath one.
Foundational AI security is a category-defining bet, and a bet that deserves a stage that matches it. Putting 7AI on the Sphere was a way of saying it out loud. We intend to be the layer this era of security is built on, giving security leaders a long-term solution to modern security operations.
Skyline to show floor
We then decided that we had to continue the momentum from the Sphere to the booth, where the meaningful conversations would be happening. We wanted attendees to come and talk to our engineers, the people running and building the product. We wanted them to hear directly from them what foundational security is and where our product is going.
To do this, we intentionally put limited messaging on the booth. Outside of our logo and "Foundational AI Security," we didn't have any other words. This inspired curiosity, and attendees came inside to see our product in action.
What also sparked curiosity was our limited edition t-shirt giveaway. Many people asked, "What does Marilyn Monroe have to do with security?"
We'd worked with Magnum Photos to put the work of legendary photographer Eve Arnold on a limited run of 7AI shirts for Black Hat, including one of her most iconic portraits of Marilyn Monroe. Arnold spent years photographing Monroe not as a headline, but as a person: curious, private, real. That's the version we wanted people wearing. And it's not far from how we think about our own work: look past the surface, and pay attention to what's actually there.
Moving beyond the AI SOC
On Wednesday afternoon, our CEO Lior Div sat down on stage with Adam Fletcher, Chief Security Officer at Blackstone, the world's largest alternative asset manager, and a 7AI customer. Together, they talked about what it takes to run an AI-driven SOC in production.
Fletcher was candid about how Blackstone transitioned to agentic security. His team was already building with AI for their own security use cases and wanted to see what a frontier model could do with their alerts. They tested it the way every security team would: measuring the agents' decisions against a simple bar. Would a human analyst have reached the same one? Comfort grew from evidence, not promises. He was honest about the edges, too. Some things, like fully autonomous remediation, aren't there yet, but he sees them coming.
Lior described the way to introduce AI into security operations. Let the agents do the work first, then layer in response, then the human controls, then the federated approach to data. Even when a human still reads and approves every action, the efficiency gain is real. The point is to meet people where they are.
Fletcher's advice to the CISOs in the room was some of the most useful content in the session. His team has met with most of the companies in this category, and his take was that they can really blur together. He filters through these companies by looking past the demo, at the people. Who's leading the company? Have they built products, teams, and businesses before? Then do the hard work: a POC. On cutting through the noise, Lior was blunt: don't just take his word for it, talk to the people who are actually customers. Fletcher agreed; POCs are hard and nobody feels they have time, but a happy reference customer is the real tell.
What is in store for the future? They agreed that AI agents are proven, but what isn't is a SOC with no humans in it. Fletcher thinks analysts are becoming more effective, not less, because AI is a force multiplier for the work that takes real judgment: hunting threats and investigating the unknown. The urgency is on the other side of the board where even disorganized attackers now have frontier-grade models at their fingertips.
Beyond the booth
Some of the most useful hours of the week didn't happen at the booth at all, and they weren't really ours to lead. They belonged to the security leaders in the room.
If the theme of the week was that CISOs are the ones feeling the urgency, the smaller gatherings were where we did more listening than talking. On Tuesday, we hosted a small group of customers and partners at our suite in the Venetian, a dozen or so people, a view of the Sphere during our takeover, and no agenda beyond real conversation. The next evening, alongside GuidePoint Security, we brought together around fifty CISOs and security leaders at Zero Bond for a night we called Coming Full Circle: the same questions Lior and Adam had worked through on stage, this time as an honest, off-the-record discussion among the people living them.
Add in our time across the GuidePoint Security Innovators dinners and the Greylock CXO reception, and the throughline was the one we'd been hearing all year. This shift is being figured out by a community, together. We'd rather be in the room for that than talk over it.
What's next?
We came to Black Hat with the question we'd been hearing all year: now that AI agents in the SOC are proven, is it the whole answer? Here's ours: the agents were just the beginning. The answer that lasts is the foundation underneath them: data, intelligence, and action. As Adam Fletcher put it, no one wants to replace their SOC infrastructure every year. So the choice has to be right the first time, and that's what a foundation is for.
The foundation is built. What's ahead is putting it to work for more security teams, for more teams who've decided that AI security is a problem worth solving now.
If you came and saw us in Vegas, thank you. If you didn't, take Adam's advice: don't just take our word for it. Come see the platform, and talk to the people already running it.
.jpg)
