Florian Voss

The reasoning is that attacks now run at machine speed — breakouts in seconds, AI-generated phishing, exploits on demand — which a queue-based human workflow cannot match, while the consequential call should still be made by a person. In Voss's phrasing this is an "agentic SOC: AI executes, humans decide."

The AlertZero post opens with "What if your alert queue stopped setting your priorities?" and previews Elastic Security Labs' four AI agents — Triage, Hunt, Detection, Forensics — each given one job and each proposing evidence-backed actions an analyst can approve, modify or dismiss.

• Voss stresses that the analyst chooses how much to delegate and that nothing consequential happens without their say-so.
• A shorter post makes the same point from the other direction: it quotes the objection "AI will replace SOC analysts", answers "Not really", and says AI replaces the boring parts rather than the critical thinking, leaving the future analyst with "less clicking, more strategy."
• Note that AlertZero is Elastic Security Labs' product being described, not Voss's own tool or independent testing.

The emphasis moves.

• One post is bare reassurance that AI will not take analyst jobs; the AlertZero post goes further and describes a mechanism — named agents, explicit approval steps, delegation as a dial the analyst controls.
• The argument develops from "this will not replace you" towards "here is the arrangement that keeps you in charge."

Read original · Original 2 · Original 3

The reasoning follows from that: if the attack is cheap and the fake arrives exactly where the checks are, then detection tuned to older signals falls behind, and the answer is not more of the same but a shift to behavioural analytics, unified identity data, and faster AI-assisted response.

The post states the correction plainly — "Social engineering didn't get smarter.

• It got cheaper." — then names the three things to prioritise instead.
• The supporting explanation lives in the Elastic Security piece it links to, not in the post itself.

Read original

The implicit argument is that the evidence an audit demands should fall out of how operations are run rather than be assembled after the fact; the session being promoted is about building audit-ready operations that support compliance "without adding more complexity."

The post opens with "The clock is ticking on NIS2" and poses the three-part proof question, then invites readers to a 9 July session on audit-ready operations with a registration link. The how-to detail sits in the linked session rather than the post.

Read original

Rather than listing features, the post reduces Elastic Security to a single workflow — "One platform.

• Ingest, detect, investigate, respond." — with AI-powered triage.
• The reasoning implied is that splitting those stages across separate tools is where time and context are lost, and that the check on the claim is watching an analyst work rather than reading a specification.

The post promotes an on-demand webinar that walks through the consolidated workflow and ends with a live analyst demo; the demo is the credibility device, and the post itself only promises it.

Read original

The workshop invitations promise hands-on exercises, real-world use cases and tips from the sessions' own experts, with free registration — endpoint protection built around Elastic Agent and Elastic Defend, and fraud detection with machine learning. Voss also posts in German as well as English, which points to German-speaking security teams as part of the intended audience rather than an afterthought.

The endpoint-security workshop post describes recognising threats early, securing endpoints and investigating incidents faster through practical exercises; the same German text appears twice in the supplied material, once on the main LinkedIn domain and once on the German one, so it is one item and not two.

• A separate post invites readers to "see fraud detection in action", building smarter fraud detection with Elastic and working through real-world use cases they can apply straight away.
• In both cases the substance is in the linked session rather than the post.

The German-language post is an audience difference rather than a change of view: the same practical-workshop approach is aimed at a German-speaking readership alongside the English posts.

Read original · Original 2 · Original 3

A short argument in bullet form: attackers now move “at machine speed,” with breakouts in seconds, AI-generated phishing, and exploits on demand.

• Voss says AI is no longer the advantage but the baseline, and names the shift as an “agentic SOC: AI executes, humans decide,” closing with a link and hashtags.
• It is a framing post rather than a technical walkthrough — no tool details, no measurements — so read it for the position, not the proof.

For brands planning a campaign

Gives a ready-made framing device for a co-branded webinar or thought-leadership piece: “AI executes, humans decide” works as a session thesis and an audience question about where a security team draws the delegation line.

Voss opens with a question — “What if your alert queue stopped setting your priorities?” — and describes Elastic Security Labs’ AlertZero preview: four agents (Triage, Hunt, Detection, Forensics), each with one job, proposing evidence-backed actions the analyst can approve, modify, or dismiss.

• The emphasis is on the analyst choosing how much to delegate and nothing consequential happening without approval.
• The post summarises a vendor preview; it is not Voss’s own tool or independent testing, and the full walkthrough sits behind the link.

For brands planning a campaign

A co-branded webinar could pick up the post’s own hook — “you choose how much to delegate” — as a live demo or panel question, with the four-agent split as the structure for the session.

Voss quotes the objection “AI will replace SOC analysts” and answers it in three lines: AI replaces the boring parts, not critical thinking; the future analyst is “less clicking, more strategy.”

• It is an opinion stated plainly, with a link to a longer piece and hashtags for SOC and automation.
• Nothing here is evidenced with data, so treat it as a stated position rather than a finding.

For brands planning a campaign

Reassurance angle for enterprise security buyers: an AI pitch that leads with removing repetitive work instead of headcount reduction, and a webinar opener that names the fear before answering it.

Voss argues AI lets one attacker do the research, personalisation, and impersonation that used to need a whole team — including deepfake voice and video at the verification step, which is where identity checks previously held.

• He points to an Elastic Security piece and names three things to prioritise instead: behavioural analytics, unified identity data, and faster AI-assisted response.
• The post is a pointer to that longer explainer; the reasoning behind legacy detection falling behind lives behind the link, not in the post.

For brands planning a campaign

Strong topic fit for identity, fraud, and verification campaigns: the deepfake-at-verification angle and the three named priorities give a webinar or article a concrete spine.

A German-language invitation to a hands-on workshop covering Elastic Agent and Elastic Defend: recognising threats early, protecting endpoints, and investigating incidents faster, described as practical exercises with tips “directly from our experts,” free to register.

• Hashtags include #ElasticDefend, #EndpointSecurity, #SOC and #BlueTeam.
• The identical post also appears under a second URL on the German LinkedIn domain (https://de.linkedin.com/posts/florian-voss-b23b4a96_hands-on-elastic-security-workshop-vom-schnellstart-activity-7491040442369888256-iKSJ), so this is one item, not two.

For brands planning a campaign

Format precedent for a hands-on lab rather than a talking-head webinar, and a reminder to plan German-language assets if the campaign targets DACH security teams.

Voss opens with “The clock is ticking on NIS2” and a three-part question security teams have to answer: can you quickly prove what happened, how you responded, and whether controls were effective?

• The call to action is a July 9 session on building audit-ready operations that support NIS2 compliance without adding complexity, with a registration link.
• It is a promotion for that session; the how-to detail is not in the post.

For brands planning a campaign

A regulatory hook for enterprise campaigns with European customers, and a workable session angle that connects detection tooling to audit evidence rather than to threat statistics.

A short invitation to a hands-on workshop on building smarter fraud detection with Elastic, covering real-world use cases and practical experience readers can apply right away, with a registration link and hashtags for #FraudDetection and #MachineLearning. As with the other workshop posts, the substance is in the linked session rather than the post itself.

For brands planning a campaign

Opens a second vertical — fraud and machine learning — so a single collaboration can be pitched to security and fraud teams, or split into two sessions.

Voss describes an on-demand webinar that positions Elastic Security as a single workflow — “One platform.

• Ingest, detect, investigate, respond.” — with AI-powered triage and a live analyst demo at the end, plus a link and hashtags for SIEM and SecOps.
• The demo is the credibility device; the post itself only promises it.

For brands planning a campaign

On-demand webinar plus live demo is the format already in use here, so a new collaboration can either follow that proven shape or differentiate by adding independent measurements the promotional posts do not carry.

In one post he describes attackers breaking out in seconds, generating phishing, and running exploits on demand, and frames the response as an "agentic SOC" where AI executes and humans decide.

• Another post previews Elastic Security Labs' AlertZero, four AI agents (Triage, Hunt, Detection, Forensics) that propose evidence-backed actions an analyst can approve, modify, or dismiss, with the analyst choosing how much to delegate.
• A third directly rejects the claim that AI will replace SOC analysts, saying it replaces the boring parts rather than the critical thinking, and that the future analyst does less clicking and more strategy.

Recurring framing device: state a common claim or fear, then correct it with a practical split of labour between machine and analyst.

For brands planning a campaign

Directly relevant to the vendor brief on SOC and AI-driven detection.

• A co-branded webinar could be built around controlled delegation: which agent actions are safe to automate, which stay with the analyst, and what evidence an analyst needs to approve an AI-proposed action.
• Voss already writes in this structure, so the argument does not need to be invented for the collaboration.

Examples: Source 1 · Source 2 · Source 3

The post points to legacy detection falling behind and names behavioral analytics, unified identity data, and faster AI-assisted response as what to prioritise instead.

For brands planning a campaign

Useful for identity, fraud, or verification-led campaigns aimed at security and risk teams. The angle Voss already supplies is concrete and testable: attacks are cheap now, so the weak point is the verification step, not the sophistication of the attack.

Examples: Source 1

Registration is free.

Promotional format built around a live exercises-and-tips session rather than a product announcement.

For brands planning a campaign

Shows a working format rather than a topic alone: Voss promotes practical, registration-driven sessions where attendees use the tooling.

• A vendor wanting a joint webinar can reuse this shape.
• Note that the same German workshop text appears in two of the supplied entries.

Examples: Source 1 · Source 2

For brands planning a campaign

Adds fraud detection to the shortlist of topics a vendor can pitch alongside SOC and endpoint work, and again shows the hands-on workshop as his established delivery format.

Examples: Source 1

The post promotes a session on building audit-ready operations that support NIS2 compliance without adding complexity.

For brands planning a campaign

Opens a compliance-led route into enterprise security buyers who may not respond to detection-technology messaging. The hook is proving response after the fact, which pairs naturally with the audit and evidence themes in his SOC posts.

Examples: Source 1

It promotes an on-demand webinar showing how Elastic Security pulls those stages together, with AI-powered triage and a live analyst demo at the end.

For brands planning a campaign

Supports a platform-consolidation or SIEM-replacement angle, and shows he will carry a message that ends in a live analyst demonstration. Pair with the agentic-SOC items for a webinar proposal that moves from consolidation to controlled AI delegation.

Examples: Source 1

The approaches are equally consistent.

• Short argument-first posts set up a claim or fear and then correct it; longer posts point to an explainer, walkthrough, or report; the rest are workshop and webinar invitations with a registration link.
• The one clearly different entry is the German-language workshop post, which suggests the audience is not exclusively English-speaking.

No post in the supplied corpus presents a contradicting or minority view that would change a campaign choice; the topics reinforce each other. The German post is a language and audience difference rather than a disagreement.

For brands planning a campaign

For planning, treat Voss as a security-operations specialist who works through vendor explainers and live sessions rather than a general commentator. The safest collaboration formats are the ones he already uses: a hands-on workshop, an on-demand webinar with a demo, or a short argument post that links to a longer explainer.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5 · Source 6 · Source 7 · Source 8 · Source 9

Several posts use first-person vendor framing ("our Hands-on Workshop," "our experts"), which indicates a close working tie to Elastic, but the posts do not state employment, ownership, or a paid sponsorship, so the exact relationship is unstated.

View example

Andrade's central question, what authority we are giving AI and how we continuously verify it, is the same delegation problem Voss frames as "AI executes, humans decide". They also share the underlying worry about autonomous attacks moving faster than human workflows can follow.

Andrade stays at the level of identity and governance principles, extending Zero Trust to autonomous identities and setting out controls such as least privilege, short-lived credentials, and logging every agent action. Voss works through vendor explainers, product walkthroughs, and event invitations, with less emphasis on formal governance frameworks.

Read original · Original 2

Conti's adversarial-thinking course teaches readers to see how systems actually behave, which parallels Voss's point that critical thinking is the part of the analyst job AI does not replace.

Conti teaches attacker mindset and military strategy at training events such as DEF CON and Black Hat, and avoids product-specific content. Voss's teaching is tied to specific tooling and operational workflow, through Elastic-themed workshops and webinars that end in a live demo.

Read original · Original 2

Murphy's "how do we govern something that keeps changing" matches Voss's concern with keeping a person on the consequential decision, and both see the human/control layer, not the model, as where the value and the risk sit.

Murphy writes from a CIO and enterprise-leadership angle about AI value, context infrastructure, and business strategy across the whole organisation. Voss stays inside security operations, detection and response, and endpoint tooling.

Read original · Original 2

Andrade's reviewed posts argue that AI agents are not another application but autonomous identities with credentials, API access, and access to sensitive data, that Zero Trust has to extend to those identities, and that the useful question is what authority an organisation gives AI and how it continuously verifies that authority. That targets security architects, risk owners, and AI-governance teams, a buyer group Voss's detection and triage material is less directly aimed at, and it gives a thought-leadership placement or a session on securing agentic AI a ready-made argument to build on.

None of Andrade's reviewed posts is a registration-driven webinar, hands-on workshop, or lab.

• They are positions stated in text, with no live demo, exercise, or event format a vendor could reuse, whereas Voss's reviewed material is built around co-branded vendor sessions.
• A vendor wanting a repeatable event format would be asking Andrade to work in a shape the evidence never shows them producing.
• The brief's SOC-detection framing would also need to be recast in identity and governance language, and no audience figures, engagement history, or commercial terms appear for Andrade in the reviewed material.

Examples: Source 1 · Source 2

Conti's reviewed posts advertise two hands-on courses delivered through a named training provider: adversarial thinking at DEF CON Training, and military strategy and tactics for cybersecurity at Black Hat.

• Both are described as structured and exercise-based, down to lock picking, insider-threat role play, fraud scenarios, and an optional certification exam, and both name the exact skills participants leave with.
• That gives a vendor a concrete teaching format and a recognised conference setting to attach to, in the same way Voss's hands-on workshop posts give the vendor an event to build on.

Conti's teaching is deliberately tool-neutral.

• It covers how attackers see systems, how assumptions and dependencies fail, and how to plan campaigns — not the operation of a specific detection platform — so a vendor would be sponsoring the education rather than demonstrating its product inside it.
• Neither reviewed post mentions a vendor collaboration, a registration page on a sponsor's domain, or a co-branded session, and there are no audience or engagement figures and no stated commercial terms.
• Conti is also tied to named in-person conference dates, a slower and more seasonal vehicle than an on-demand webinar.

Examples: Source 1 · Source 2

The reviewed posts work at that level: one argues that the arms-race narrative confuses boards and that the organisations that gain are the ones that invest early in context infrastructure, clean data, semantic meaning, and identity-aware retrieval; the other examines self-evolving AI and reframes the question from how to maintain a system to how to govern one that keeps changing. A vendor with an executive-facing thought-leadership piece, an executive roundtable, or a strategy webinar would find the vocabulary and audience framing already established, which is a different sale from the technical delegation question Voss's material supports.

This is strategy commentary, not detection practice.

• Neither reviewed item shows hands-on SOC work, triage, or product operation, so a vendor could not lean on Murphy for the technical demo that the brief's SOC-detection angle implies.
• One of the two items is a response to another author's article rather than an analysis of its own, and both point to longer pieces that were not supplied, so the underlying work cannot be assessed.
• There is no evidence of vendor webinars, workshops, or registration-driven campaigns, no audience figures, and no commercial terms.

Examples: Source 1 · Source 2