Andrew Krioukov

AI-driven attacks now operate at machine scale, with mean time to exploit collapsing from 23 days to just under 2 days. SIEMs as we know them today are going to disappear because this new agentic era you are dealing with unprecedented threats. That’s why Databricks announced Lakewatch, the Open Agentic SIEM. Instead of locking security data into proprietary systems with per-byte ingest licensing, Lakewatch lets teams store all their security telemetry in open formats, retain it for years, and run agentic AI across it. Security teams gain complete visibility across the enterprise and can deploy defensive security agents to automate threat detection and response at massive scale.

In the AI era, security is fundamentally a data problem. As cyberattacks shift from human-operated to machine-scale autonomous agents, traditional security architectures have hit a breaking point, forced into a "fidelity trade-off" between spiraling costs and dangerous visibility gaps. Join us for the Cybersecurity Industry Forum to discover how Databricks is disrupting the legacy SIEM market with Lakewatch, the industry’s first open, agentic SIEM built on the security lakehouse. This 90-minute session explores how to “fight fire with fire” by deploying swarms of defensive AI agents to meet machine-speed attackers. We will dive into the architectural shift required to unify security, IT, and business data into a single, governed environment, eliminating the “ingestion tax” and enabling petabyte-scale detection and response at a fraction of the cost of legacy providers. Hear from security innovators and Lakewatch design partners who are moving beyond experimental AI to operationalize agentic security at scale. Learn how to leverage open formats (OCSF) and “Detection-as-Code” to build a proactive, high-velocity SOC that identifies threats in minutes, not days.

This session will explore how Adobe uses a sophisticated data security architecture built on the Databricks Data Intelligence Platform, along with the Open Cybersecurity Schema Framework (OCSF), to enable scalable, real-time threat detection across more than 10 PB of security data. We’ll compare different approaches to OCSF implementation and demonstrate how Adobe processes massive security datasets efficiently — reducing query times by 18%, maintaining 99.4% SLA compliance, and supporting 286 security users across 17 teams with over 4,500 daily queries. By using Databricks' Platform for serverless compute, scalable architecture, and LLM-powered recommendations, Adobe has significantly improved processing speed and efficiency, resulting in substantial cost savings. We’ll also highlight how OCSF enables advanced cross-tool analytics and automation, streamlining investigations. Finally, we’ll introduce Databricks’ new open-source OCSF toolkit for scalable security data normalization and invite the community to contribute.