Security Operations
The Brick House Special: From Data Overload to Decision-Driven Security
Quotes from The Brick House #60
EVENT SPEAKERS
Learn from Cybersecurity Experts
Gary Brickhouse
Gary leads the GuidePoint Security’s information security program and manages the GRC Services consulting practice. His expertise spans compliance, data privacy and securing technologies, honed through previous roles at The Walt Disney Company and Publix Super Markets. A frequent industry speaker, Gary holds a CISSP certification, ITIL v3 Expert credential and a Bachelor of Science from Florida Southern College.
Myke Lyons
Myke Lyons is the Chief Information Security Officer (CISO) at Cribl, leading the charge in operational, AI and corporate security. He oversees governance, risk and compliance programs, in addition to guiding Cribl through its FedRAMP journey. Myke’s career spans over two decades, with previous roles as the CISO at Snyk and Collibra, championing security governance and advocating for data and AI products.
Adán Montoya
Adán Montoya is an Enterprise Security Architect in Security Partner Development at Google Cloud Security, with more than 30 years of experience securing global enterprise environments. His career includes modernizing security programs for the Transportation Security Administration, Department of Veterans Affairs and Fortune 500 organizations across federal, healthcare and commercial sectors. The first person to earn Google’s Professional Security Operations Engineer certification, Adán specializes in agentic SOC environments, AI-driven security operations and translating complex technical innovation into business outcomes.
Ryan Kazanciyan
As CIO and CISO, Ryan leads Wiz’s security and technology teams, including security engineering and operations, risk & compliance, IT, business systems, public sector and enterprise resilience. Ryan joined Wiz as its founding CISO in 2022, scaled the company’s security and IT teams as the company grew from 200 to over 2000 employees and led the integration process as Wiz became part of Google Cloud in 2026.
About The Partner Special Brick House:
Inside the Episode
Why do security teams have too much data but still can't tell what matters?
Because visibility has outpaced context. Most organizations can now see across their environment, but the raw volume of alerts, findings and vulnerabilities arrives without the context needed to tell a true positive from noise. Knowing what’s normal versus abnormal — and which asset or identity is involved — is what makes data actionable.
How do you reduce security alert noise and false positives?
Add context before volume. Enriching events with asset criticality, identity and environment lets teams (and AI agents) separate real signal from noise, instead of drowning in low-value alerts. The same context that helps a human analyst triage is what an AI agent needs to act reliably.
Should you collect and retain all your security log data?
No — collecting everything is no longer a sound strategy. Even platforms that can ingest petabytes a day don’t make “keep it all” worthwhile. Separate the use cases: detection, compliance retention and threat hunting need different data, retention windows and systems. Tier data by value and purpose.
Does agentic AI actually help in security operations?
Yes, when it closes the loop between finding and fixing. Specialized agents can collaborate — one validating vulnerabilities, another proposing and testing detections — freeing engineers for complex, poorly understood surfaces. The risk: teams that don’t use AI against their operational data are already behind attackers who do.
What are toxic combinations in vulnerability prioritization?
Toxic combinations are risk factors that are dangerous together even when each looks minor alone. Instead of scoring a vulnerability in isolation, you weigh the blend of exposure, identity risk, data risk and workload context. That combination is what surfaces the genuinely critical issues out of thousands of findings.
How should security teams balance prevention and detection?
Treat the balance as something to re-check constantly, not set once. Not everything is preventable, so detection buys time and catches what isn’t yet well defined. Teams that over-trust their architecture — or lean too hard on the SOC to catch preventable issues — have the balance wrong.
How do you start using AI in security without a big program?
Start with a pilot and don’t wait for perfect. The landscape moves too fast to wait for stability — pick one meaningful use case, use the free resources available and improve from there.
