Cisco's Security Operations Center (SOC) at its Cisco Live AMER 2026 event in Las Vegas served as a multifaceted educational platform, offering attendees and staff insights into real-world cybersecurity operations. The event SOC not only protected the conference infrastructure but also facilitated learning through various interactive formats, including tours, dedicated sessions, internal training, and direct engagement with attendees.
The SOC tours provided a practical demonstration of how the security team collaborated with the Network Operations Center (NOC) to monitor live conference traffic, investigate suspicious activities, and safeguard the attendee experience. These tours highlighted the integration of networking, security, and observability, particularly emphasizing the relevance of Cisco Cloud Control and the importance of shared operational context for rapid response.
Educational sessions delivered by SOC personnel brought live operational experiences into classroom settings. These included a DevNet session focused on coding and API-based automation, a hands-on lab, and a technical seminar for in-depth architectural discussions. A notable "purple team" lab allowed attendees to engage with both red team and blue team activities, simulating real advanced persistent threat (APT) group tactics. This lab also showcased how agentic AI could accelerate detection and remediation processes, while still requiring human validation and decision-making.
Internal to the SOC, a dedicated "Training SOC" provided newer team members with a hands-on learning environment. This space allowed them to familiarize themselves with the event network, toolchain, and the handoff procedures between the SOC and NOC before fully engaging in live investigations. Experienced analysts guided new members through example detections, evidence review, and discussions on the unique context of event security compared to steady-state enterprise environments, helping to build confidence and establish repeatable learning processes.
Beyond structured learning, informal conversations in the World of Solutions exhibit hall offered a different educational avenue. Attendees posed questions about alert fatigue, visibility, automation, team handoffs, and SOC maturity. These discussions created a two-way exchange, allowing the SOC team to share their operational insights while also gaining feedback on areas where Cisco's offerings could be improved for real-world environments.
Cisco emphasized that event SOCs provide a unique environment for pressure-testing technology and processes that cannot be fully replicated in a lab. The temporary, high-stakes, and rapidly deployed nature of the event network forces teams to identify effective solutions, workflow bottlenecks, and opportunities for better integrations or automation. This operational feedback loop not only contributes to a more secure event but also informs product development and strengthens baselines for future deployments. The company views the SOC as a premier classroom, teaching through the direct experience of real-time operations.
