New Goat scenarios turn 2025-2026's real Kubernetes and container-runtime research — rootkits, eBPF backdoors, runc escapes, and more — into automated attack chains you can run against your SOC.

In a live run of the Part 2 attack, Stream.Security's AI SOC detected the compromised key, reconstructed the full attack chain including a hidden persistence backdoor, and deleted the stolen credential on its own, stopping the attack in about ten minutes with no human in the loop. Part 4 of the Building the Agentic SOC series is about the decision that made that safe: which response actions a human lets an AI agent take autonomously, and why that call belongs to the Security Architect.

An AI agent given a single leaked AWS key escalated from a low-privileged Lambda user to full account takeover in under 25 minutes, wrong turns included. Part 2 of the Building the Agentic SOC series walks through the attack step by step, from credential theft to a brute-forced admin identity, to show exactly what the agentic SOC has to detect and stop.

Security Architects are measured on how well they design defense, almost never on how well the SOC can respond to what that design misses. As AI turns the SOC from an organization into a system of agents, closing that gap becomes an architecture problem, and the Security Architect is the only one positioned to own it. Part 1 of a series building an agentic SOC hands-on with the open-source CDRGoat project.