Sindre Breda
Police officer turned computer forensic investigator, turned analyst/developer. Sindre started his career as a street cop that quickly switched to computer forensics/mobile forensics with key focus on online child abuse.
From 2018 he worked at the Norwegian "National Criminal Investigation Service", more commonly known as Kripos.
At Kripos he worked with analyzing data that the commercial forensic toolkits did not parse/present, most actively in the investigations of the ransomware attack against Norsk Hydro in 2019. Currently working as a Solutions architect at Graphistry.
Session
A hands-on 8-hour workshop on building AI systems that run real security investigations - not just isolated copilot tasks. Most teams get useful help from Claude or ChatGPT on single questions. Few can reliably run multi-step investigations across logs, tools, and incidents.
Taught by instructors behind the most popular Black Hat 2025 AI training and the team that built the first AI agent to autonomously solve the Splunk Boss of the SOC CTF.
Investigation agents fail not because of model quality, but because investigations are multi-step, ambiguous, and tool-heavy - small errors compound and there are no unit tests to keep things on track.
Four labs:
Lab 1: Run an OSS LLM locally and watch it hallucinate on SOC questions
Lab 2: Wrap it in an agent harness against Splunk BOTSv3
Lab 3: Author a plan.md timelining skill
Lab 4: Score it, error-analyze traces, fix the skill, watch the score move
Concept blocks cover harness anatomy, MCP and skills, planning patterns, evals, agentic memory and RAG, and securing agents against the lethal trifecta.
You leave with a working agent, a reusable skill, an eval harness, and a methodology.
Audience: SOC, IR, threat hunters, detection engineers, architects, technical leaders.
Prereqs: Laptop, terminal comfort, optional Python. Pre-work to install harness + pull local model.
We bring: LLM API key for attendees, bring your own key if prefered.