SharpHound Recon Attack: How AI Enhanced the Threat Hunt
Cisco, Tuesday, July 7th, 2026
Cisco and Endace used AI plus full packet capture at Cisco Live to rapidly investigate a suspected SharpHound recon attack.
This article describes how Cisco and Endace deployed AI alongside full packet capture during Cisco Live AMER 2026 to investigate a potential SharpHound reconnaissance attack.
The team built an agentic SOC integrating multiple security tools with AI, enabling automated analysis that produced a well-written report within minutes.
The AI-assisted investigation ultimately determined the activity was benign, demonstrating how agentic AI can accelerate threat assessment while keeping less-experienced analysts productive.