As Black Hat USA 2026 approaches, security leaders are bracing for a threat landscape that looks nothing like it did even 18 months ago — one increasingly defined by agentic AI operating on both sides of the fight. Ahead of the show, VMblog sat down with Karthik Kannan, Founder & CEO of Anvilogic, to talk about how his company’s Agentic SecOps platform is built to keep pace with attackers moving at machine speed, and why he believes the industry’s biggest blind spot isn’t a lack of AI, but a lack of data grounding underneath it.
Kannan doesn’t shy away from a direct message for CISOs: don’t rip out the infrastructure you’ve already invested in to go modern. At Booth 5724, Anvilogic will bring its full Agentic SecOps platform — Federated Search, the Enterprise Security Graph, and Blueprints — together for the first time, running live investigations on real alert data rather than canned demos. In this Q&A, Kannan discusses the company’s shift away from the “AI SOC platform” label, what he thinks security leaders should prioritize for the rest of 2026, and why he believes the vendors who can prove they gave analysts their time back — not just another system to babysit — are the ones who’ll still be standing at Black Hat 2027.
++
VMblog: For readers who may not be familiar, give us the elevator pitch — who you are, what you do, and what genuinely sets you apart in today’s crowded cybersecurity market.
Karthik Kannan: Anvilogic is an Agentic SecOps platform that automates daily manual SOC functions spanning data on-boarding, detection and investigation, while allowing customers to keep their data where it makes most sense. Anvilogic thus enables enterprise security teams to scale operations without adding headcount or replacing existing infrastructure.Anvilogic’s core agentic automation capability, Blueprints, is the underlying AI technology that automates analyst functions across data on-boarding, detection, triage and investigations, and any other SOC workflow, such as hunting or maintenance, using AI agents that can operate autonomously. Anvilogic integrates with any data store such as legacy SIEMs, data lakes and object stores, and with downstream ticketing and case management systems to close the loop. Trusted by Fortune 1000 companies across financial services, technology, and critical infrastructure, Anvilogic helps organizations expand coverage and accelerate response with the teams they already have. Learn more at anvilogic.com and follow @AnvilogicSecOps on X and Anvilogic on LinkedIn.
VMblog: Black Hat attendees are a discerning crowd. What booth experiences, live demos, or hands-on activities are you bringing to Las Vegas that will cut through the noise and leave visitors with something they can’t stop thinking about?
Kannan: No slideware. At Booth 5724, we’re running live Blueprints investigations end to end on real alert data. People get to watch the Enterprise Security Graph reason through a case in real time: data onboarding, alert triaging, and case investigation.
A human still signs off before anything closes. Attendees can bring their own scenario and watch the agent work it live. That’s the demo. If it doesn’t hold up live, it doesn’t go on the booth.
VMblog: What’s your Black Hat origin story? Longtime exhibitor or fresh face on the floor? What keeps your company coming back — or what made 2026 the year to finally plant your flag here?
Kannan: We’ve been a sponsor and exhibitor at Black Hat for several years, and each year we’ve shown the platform progress and evolve, from detection engineering, to a multi-data lake SIEM, to Agentic SecOps today. That’s what we want to showcase this year: AI agents performing human workflows as the future core of the SOC.
That means this is the first year we get to put the whole Agentic SecOps platform (Federated Search, the Enterprise Security Graph, and Blueprints) together in front of the exact audience that’s going to stress-test it hardest. That’s what makes 2026 the year worth showing up for.
VMblog: If a CISO walks away from your booth remembering exactly one thing about your company, what do you want that to be?
Kannan: You don’t have to throw out what you already built to get modern detection and automation. Anvilogic runs on the data platform you already have. Its AI agents automate both persona-specific workflows and full end-to-end operations, with human oversight throughout.
VMblog: The threat landscape heading into Black Hat 2026 looks very different from even 18 months ago. Which specific threat vectors — whether that’s agentic AI attacks, identity-based intrusions, critical infrastructure targeting, or something else — is your solution most directly built to address?
Kannan: Agentic AI attacks, directly. When the attack side moves at machine speed, a SOC that still depends on analysts manually correlating logs across five tools is already behind. Anvilogic is built for that speed mismatch. We run federated detection across your data stores, with Blueprints acting on the Enterprise Security Graph fast enough to keep pace. The adversary isn’t waiting for a human to open a ticket.
VMblog: Agentic AI is reshaping both offense and defense. How is your company building security for — and with — autonomous AI systems, and what risks are you most concerned enterprises are underestimating right now?
Kannan: We use LLMs deliberately, and we watch token cost closely. The risk I see enterprises underestimate is assuming that pointing a general-purpose model at their logs means it understands their environment. It won’t, not on its own.
That’s why we built the Enterprise Security Graph: a model of the environment, its ontologies, workflows, personas, and the local knowledge a team builds over time. Blueprints acts on that graph, with a human approving the decisions that matter. Without that grounding, agentic AI is just a faster way to be confidently wrong.
We also leverage frontier models to fill the gaps with information we don’t have which not only fulfills the use case but also helps our internal graph learn.
VMblog: “AI-native security” is quickly becoming the new “next-gen.” What does that phrase actually mean at your company, and how do you demonstrate real differentiation beyond the marketing language?
Kannan: At Anvilogic it means the Enterprise Security Graph, not a chat interface stapled onto a SIEM. Real differentiation is easy to demonstrate and hard to fake. Put your own alert data in front of Blueprints on the show floor and watch it reason through the case using your environment’s actual context, not a generic model’s best guess.
VMblog: Are you unveiling any major product announcements, partnerships, or research findings at Black Hat 2026? Can you tease it or give us a preview?
Kannan: Yes. We’re bringing Blueprints to general availability, alongside Anvilogic Compute and Federated Search, all under the Agentic SecOps banner. It’s the culmination of the direction we set at RSA earlier this year. Now it’s fully in production, for customers running federated detection across Snowflake, Databricks, and beyond.
VMblog: What’s the most significant cybersecurity blind spot you’re seeing across your customer base right now, and how does your technology address it?
Kannan: Teams treating AI as a bolt-on to alert triage, instead of restructuring how the SOC runs on federated data. Faster triage on top of ungoverned, siloed data just gets you to the wrong answer faster.
Anvilogic addresses it at the layer underneath, and shifts AI-driven automation further left, into data onboarding and detection engineering. That earlier automation leads to more accurate triage and investigation downstream.
We run Federated Search across the data stores you already have, powered by Compute, so Blueprints reasons over clean, unified context instead of another disconnected feed.
VMblog: Security teams are being asked to do more with tighter budgets and leaner headcounts. How does your solution help security leaders justify ROI and actually reduce operational burden rather than add to it?
Kannan: The numbers do the talking. Customers see roughly 10x faster time to detect. They onboard new feeds in under 15 minutes and operate at close to 80% lower cost than a legacy SIEM. On the alert side, Blueprints and our AI triage cut alert volume by more than 60%. Close to half of those alerts get removed from manual review entirely, and we still hold 98% triage accuracy. That’s not a productivity slide. That’s hours an analyst gets back every single day.
Architecturally, by federating operations across data stores (object stores, SIEMs, data lakes), we reduce infrastructure costs significantly, and help drive more data storage onto lower-cost or more suitable platforms.
VMblog: What should be sitting at the very top of every security leader’s priority list in the second half of 2026?
Kannan: Get your data foundation right before you buy another AI layer to sit on top of it. I’d rather a CISO ask a vendor “does this actually understand my environment” before asking “how fast is your model.” Also, verify the platform is actually AI-native, not just an LLM wrapper bolted onto an expensive frontier model.
VMblog: Looking toward 2027 and beyond, what emerging threat or technology inflection point do you think the industry is still not taking seriously enough?
Kannan: Agentic AI will be running on both sides of the fight, attacker and defender. The defenders who win will be the ones whose AI truly understands their environment, instead of reasoning in the abstract. Generic models trained on the internet don’t know your ontologies, your workflows, or your team’s accumulated judgment. The industry is still underestimating how much that local grounding matters.
VMblog: Does your team have any speaking sessions, sponsored research presentations, or Briefings appearances at Black Hat 2026 that attendees should put on their schedule?
Kannan: I’ll be sitting down for a Dark Reading News Desk interview on the show floor. It’s recorded during Black Hat week and runs as video coverage afterward. Beyond that, the best place to catch us is Booth 5724, live, all week. To view upcoming activity, please visit this link.
VMblog: Beyond the product pitch, what’s one piece of hard-won, actionable security wisdom you’d hand to every practitioner who stops by your booth?
Kannan: Fix your data before you buy your next tool. Automation layered on top of messy, siloed, unnormalized data doesn’t fix the mess. It just automates it faster, and now you find out you were wrong at machine speed instead of human speed.
VMblog: For the first-timer navigating Black Hat for the first time — what’s your best advice for getting maximum value out of the week without burning out by Wednesday?
Kannan: Pick three things you actually need answers to and go deep on those, instead of trying to see everything on the floor. You’ll leave with more than someone who collected twice the swag and none of the clarity.
VMblog: When the industry gathers again at Black Hat 2027, what do you think will be the defining cybersecurity conversation that dominated the year?
Kannan: Whether agentic AI in the SOC gave security teams their time back or just became one more system analysts must babysit. I think the vendors who can prove the former, with real customer numbers, are the ones still standing.
VMblog: You’ve been vocal about moving away from the “AI SOC platform” label. What’s behind the shift to “Agentic SecOps,” and what does it mean concretely for customers?
Kannan: “AI SOC platform” has come to mean a thin layer that triages alerts faster and not much else. That’s not what we built, and I don’t want to be lumped in with tools that only do that.
Agentic SecOps is Federated Search across your data stores, powered by Anvilogic Compute, paired with Blueprints for agentic automation, and grounded in the Enterprise Security Graph. Concretely, it means customers get detection, investigation, and automation working together on the data platform they already run, not a triage add-on sitting on top of someone else’s SIEM.
##
