At Core4ce’s 2026 Innovation Summit, one panel stood out for its practical look at how AI is changing cybersecurity operations: a discussion on LANDO, Core4ce’s AI-powered threat hunting and SOC analyst platform.
Short for Log Analytics Network Defense Orchestrator, LANDO was built to solve a real and growing problem across the cyber industry: security teams are overwhelmed by alerts, drowning in telemetry, and under pressure to investigate and respond faster than ever. As attackers begin using AI to scale their operations, the panel made one thing clear: defenders must do the same.
Built from a Real Operational Need
LANDO did not start as a concept for a product roadmap. It started as a response to operational pain.
Tyler Poor, Core4ce’s cybersecurity analyst who created LANDO, described what it was like operating as effectively a one-person SOC—serving as the first and only set of eyes on every incident coming into the queue. The volume of alerts and the amount of manual log review required meant that time was being spent on repetitive triage rather than high-value analysis.
“I was becoming more of a data entry clerk than an actual cybersecurity analyst,” Tyler said.
That challenge sparked the idea behind LANDO: what if an AI model could perform the first-pass investigation work automatically?
What LANDO Does
Built in the Microsoft Azure Government cloud, LANDO turns natural language into executable threat hunts and helps analysts work across the full incident response lifecycle.
During the panel, the team described how LANDO can:
- Translate plain-English requests into optimized queries
- Support multiple major SIEM query languages, including KQL for Microsoft Sentinel, SPL for Splunk, and ESQL for Elastic/Kibana
- Hunt across endpoint, identity, cloud, email, and network telemetry
- Analyze incidents across 24 supported log tables
- Extract entities, enrich evidence, and map activity to MITRE ATT&CK
- Classify incidents and recommend next steps
- Generate incident response checklists and after-action reporting
- Maintain a full audit trail for accountability and traceability
In practical terms, it means analysts can ask LANDO a question such as, “Find suspicious network activity on port 22,” and the platform can automatically generate and run the appropriate hunt against the relevant data sources—without requiring the user to write a query manually.
That multi-platform capability is especially significant because Microsoft Sentinel, Splunk, and Elastic are among the most widely used SIEM solutions in today’s SOC environments. By supporting KQL, SPL, and ESQL—with additional query language support planned—LANDO is designed to meet analysts where they already work.
Core4ce’s 2026 Innovation Summit
Lowering the Barrier to Cyber Operations
One of the strongest themes from the discussion was accessibility.
Threat hunting has traditionally required specialized expertise, including the ability to write and refine SIEM-specific queries and manually correlate data from multiple tools. LANDO changes that dynamic by allowing analysts to hunt in plain English.
That capability lowers the barrier for entry-level analysts and even adjacent technical staff to contribute to tier-one cyber workflows. As Core4ce CIO Shane Breland noted during the panel, one of the biggest leaps in LANDO’s evolution came when it became clear the tool could help people who were not formally trained cyber analysts participate in triage and investigative work.
Instead of relying on a small number of experts to do everything, LANDO helps distribute the workload while preserving consistency and speed.
Evolving from Assistant to Agent
The panel also highlighted how LANDO has matured over time.
Tyler described three major steps in its evolution:
- Triage – pulling relevant data, summarizing it, and classifying incidents
- Response support – guiding or triggering playbook-based actions such as quarantine or containment workflows
- Reporting – generating a full after-action report documenting what happened and why
What began as a local script to automate follow-up queries grew into something much bigger: a virtual SOC analyst capable of operating continuously, including after hours.
One especially memorable moment from the discussion came when Shane recalled Tyler reporting that LANDO had run overnight and automatically handled dozens of incidents, leaving only a smaller set for review the next morning.
That kind of round-the-clock support matters because attackers do not operate on business hours. With LANDO, incidents that occur at 2:00 a.m. can receive the same rigorous initial investigation as those that arrive during the workday.
Innovation with Governance Built In
The panel emphasized that effective AI in cybersecurity is not just about speed. It is also about trust.
John Buelk, Core4ce’s Vice President of Cybersecurity, underscored the importance of building LANDO in a way that supports compliance, consistency, and accountability—especially in environments handling sensitive data and operating under strict regulatory requirements.
Rather than functioning as an ungoverned black box, LANDO was developed with guardrails. Its workflows are auditable, its decisions are reviewable, and its outputs support human oversight. That design approach is essential for organizations that need to balance innovation with mission assurance.
LANDO’s architecture also reflects Zero Trust principles, an important consideration for government and other highly regulated customers. The data LANDO processes remains within its governed boundary rather than being continuously sent outside the environment for processing and then returned. That approach helps organizations maintain stronger control over sensitive data and stands in contrast to many SaaS-based AI offerings that process customer data externally.
As the panelists noted, creating space for experimentation is important—but so is having a path to maturity that allows promising tools to move from individual use to team capability to enterprise adoption.
From left to right: John Buelk, Tyler Poor, and Shane Breland
Why Tools Like LANDO Matter Now
The conversation closed with a broader reflection on the future of cyber defense.
As AI becomes more available to attackers, the advantage of scale is shifting. Threat actors can use AI to increase the speed of exploitation, automate aspects of social engineering, and compress the timeline between vulnerability disclosure and active attack.
The panelists agreed that defenders cannot rely on human effort alone to keep pace.
For Shane, the issue is speed. For Tyler, it is the need to counter machine-scale offense with machine-scale defense. For John, the conclusion was simple: to keep up with AI-powered threats, defenders must automate too.
That is where LANDO fits in. It is not just a demonstration of what AI can do in cybersecurity. It is an example of what happens when frontline operational need, engineering ingenuity, and disciplined governance come together to produce something genuinely useful.
Looking Ahead
LANDO’s story is still unfolding, but the panel made one thing clear: the future of cybersecurity operations will depend on tools that can extend analyst capacity, accelerate decision-making, and help organizations respond at the speed of modern threats.
By turning natural language into threat hunts, supporting multiple major SIEM query languages, unifying telemetry into one investigative surface, and embedding AI into real security workflows, LANDO points toward that future.
And it started with a simple but powerful question: what if AI could help carry the load?
View the full panel discussion from Core4ce’s 2026 Innovation Summit: