You Can't Prompt Your Way Out of Bad Data: Why Context, Not Models, Wins in the Cloud

AI is already on the attacker's side, moving faster, blending in better, and exploiting cloud complexity at machine speed. Defenders are fighting back with AI-powered SOCs, automated triage, and SOAR playbooks. Yet most teams are still losing time, confidence, and clarity. The problem with this dynamic doesn’t lie in the AI models that defense teams are using, but rather in the data underneath those models.

This session, presented at the 2026 SANS Institute SOC, SIEM, and SOAR Forum by Jason Nations, former CISO of OG&E and Field CISO at Stream.Security, breaks down what AI is and isn't doing in modern security operations, and why defenders who win aren't the ones with smarter prompts, but the ones with data that actually reflects reality. When your AI operates on stale snapshots, stateless signals, and fragmented tooling, you're only amplifying uncertainty.

In this webinar, you’ll learn how attackers are using AI to rapidly learn cloud environments and expand blast radius in minutes, and why having a stateful, real-time model of your cloud is the only way for defense teams to operate with the same speed and clarity.

What You'll Learn

• Why AI without the right data model amplifies uncertainty instead of creating advantage
• How attackers are leveraging AI to exploit cloud complexity at machine speed
• Why most SOCs are still operating on stale posture and fragmented signals, and what to do instead
• How stateful, real-time cloud context transforms AI from a noise engine into a force multiplier