At Cisco Live AMER 2026 in Las Vegas, my work with the Cisco Event SOC centered on one outcome that makes these deployments valuable beyond the event itself: Education. The SOC protects the conference, but it also turns live operations into a learning environment through SOC tours, Cisco Live sessions, training inside the SOC, and conversations in the World of Solutions. Just as important, lessons from the event feed back into product conversations, repeatable workflows, and future deployments.
Attendees saw how the SOC works with the Network Operations Center to monitor real conference traffic, investigate suspicious activity, and protect the conference experience. The tours also showcased One Cisco in action by bringing networking from the NOC together with security and observability. With the release of Cisco Cloud Control, that connection felt especially relevant. The tours gave attendees a practical view of why shared operational context matters, especially when teams need to understand, decide, and respond quickly.
Education also happened in the sessions I delivered at Cisco Live. I used three different formats to bring live SOC experience into the room:
The purple team lab was especially valuable because attendees worked through both red team and blue team activity based on real APT group emulation. They could see how agentic AI can shorten the path from detection to remediation, while analysts still validate evidence and make the final call. Across the wider SOC team, analysts were also balancing live operations with speaker sessions, booth conversations in the World of Solutions, and hands-on coaching for newer team members.
Education also happened inside the SOC. We had extra space available during the event and used it as a Training SOC, where newer team members could learn the environment hands-on while live operations continued nearby.
That format gave new SOC members time to understand the event network, the toolchain, and the handoff between the SOC and NOC before jumping fully into live investigations. They could walk through example detections, review evidence with experienced analysts, and ask questions about the context that makes event security different from a steady-state enterprise environment.
Experienced analysts explained how they moved from signal to decision, what evidence changed their confidence, and how they documented the outcome. That helped newer team members build confidence while turning live event experience into repeatable learning for the next deployment.
The World of Solutions added a different kind of education. Booth conversations were less structured than a tour or a class, but often just as useful. Attendees brought questions about alert noise, visibility, automation, handoffs between teams, and how to mature a SOC without adding friction for analysts. Those conversations made the education loop two-way: we shared what we learned from operating the Event SOC, and customers helped us see what needs to be clearer, easier, or more useful in real environments.
Event SOCs pressure-test technology and process in a way a lab cannot fully recreate. The environment is temporary, noisy, high stakes, and built quickly. That forces the team to see what works, where workflows slow down, and where better integrations or automation can make a difference. The outcome is not only a safer event, but better product feedback and a stronger baseline for the next deployment.
Cisco Live AMER 2026 reinforced that the SOC is one of the best classrooms we have because it teaches through real operations.
For a deeper look at the model behind these deployments, read the Cisco Event SOCs: A Reference Architecture and Operations Guide.
At the next Cisco Live or Cisco-supported event, book a SOC tour. It is one of the best ways to see the Event SOC in action and take practical lessons back to your own SOC.
Check out the blogs by the engineers who worked inside the SOC at Las Vegas:
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。