Nebulock’s Alex Hurtado on why current logs fail to distinguish AI agents from info stealers

Future of Threat Intelligence · Oct 8, 2026 · 41m

Over 60% of false positives trace back to vendor-provided detection rules. That finding, from a first-of-its-kind SANS report Alex Hurtado helped produce, captured why detection engineering has become its own discipline, one that treats rule management like a CI/CD pipeline.

Alex, Head of Detection Strategy at Nebulock, breaks down how AI is reshaping the detection lifecycle, from query generation to self-healing alert tuning, and flags a critical blind spot where current logs cannot distinguish a legitimate AI agent action from a malicious one.

Topics discussed:

Treating detection rule…