CYBERUK 2026 Tech Talk - AI in incident response: What worked, what failed, and what we learned

During a major security incident, responders face an overwhelming challenge: thousands of logs, hundreds of findings, and executives demanding answers within minutes. Meanwhile, threat actors appear to be using AI to accelerate their attacks, creating an arms race where defenders must evolve or fall behind. This was Amazon's reality responding to customer incidents. Through trial and error, they learned where AI genuinely helps, where traditional automation suffices, and where human expertise remains irreplaceable. This session shares their journey building AI and automation into incident response. Ben Fletcher discusses which tasks suited traditional automation versus where AI added real value, and importantly, what failed under real incident pressure. You'll learn how they built these capabilities incrementally and integrated them without disrupting responders. Speaker: Ben Fletcher, AWS Security Incident Response Engineer, Amazon