Monzy Merza on Crogl: AI for Security Analysts and the CISO's Conundrum

The CISO's Conundrum: Bandwidth and Tooling Challenges

• 🎯 CISOs face a bandwidth problem due to the expansion of AI, which increases both users and potential adversaries, leading to a surge in alerts.
• ⚠️ Security analysts are often hindered by the sheer number of tools (average of 45+ technologies) and the complexity of querying disparate data sources (data lakes, EDR systems).
• 💡 The core issue is that tools get in the way of analysts, who know what to do but struggle with data location, query languages, and integrating results.

Crogl's Solution: An Autonomous Analyst

• 🚀 Crogl is described as an autonomous analyst, a knowledge engine designed to investigate alerts, execute threat hunts, and document its work.
• 🧠 The goal is to make every security analyst as effective as an entire team by empowering them to exercise their intuition without being impeded by technology.
• 🧩 Crogl addresses two main problems: data normalization and process execution.

Addressing Data and Process Challenges

• 💡 Crogl builds a knowledge graph that creates a semantic layer over enterprise data lakes, eliminating the need for data normalization and understanding complex schemas.
• 🛠️ It learns and executes processes from analysts' work, making it repeatable and shareable across the team, thus shrinking collaboration friction.
• ✅ The system sensitizes individual work with colleagues' contributions, fostering camaraderie and allowing analysts to take credit for their impact.

AI as a Compound System

• 🤖 Crogl utilizes a compound AI system that includes LLMs, retrieval augmented generation, agentic workflows, and relational databases.
• 🔒 A key innovation is the ability to run Crogl in an internet-disconnected, customer-managed environment, ensuring privacy and control.
• 📈 This compound AI approach allows for documented, inspectable, and auditable outcomes, moving beyond singular AI mechanisms.

Productivity and User Satisfaction

• ⚡ Crogl significantly boosts analyst productivity by automating alert investigation and documentation, allowing them to focus on critical tasks.
• ✨ User satisfaction stems from enabling analysts to exercise intuition, contribute meaningfully, and receive credit for their work, flipping the model from blame to recognition.
• 🏆 An example highlights an analyst using Crogl to solve a multi-million dollar fraud case, demonstrating the system's power in connecting disparate data and articulating complex ideas.

Hope at RSAC 2025

• 🤝 The cybersecurity community remains committed and is at another inflection point with the AI inflection point.
• 🚀 There is optimism about AI's potential to enhance protection and foster a new ecosystem for security.
• 💬 The industry is ready to embrace the unknown and collaborate to build the future of security.