Speaker: Jürgen Morgenstern

Large language models today are confident conversational partners — even when they lack the evidence needed to reach a correct conclusion. For security teams, that becomes a real risk: an AI-assisted threat analysis sounds just as convincing when it's right as when it's wrong.

This talk uses a concrete, real-world case to show why the data foundation — not the model — determines the quality of an AI-assisted security analysis. At its center is an actual DNS exfiltration attempt from a lab environment: the same AI agent, the same prompt, the same incident — investigated twice. Once with standard flow and metrics data, once with packet-based telemetry.

Two short investigation videos show the direct comparison: with identical model and identica ...