The “digital workforce” era in cyber security operations

ANKARA (AA) – Treating cyber security as one of the most important elements of national security, Barikat Cyber Security aims to make processes ranging from alarm analysis to action plans in security operation centers faster, more consistent and scalable with its artificial intelligence-supported digital workforce model. The second day of the AI Tomorrow Summit 2026 event, organized by the Artificial Intelligence Policy Association (AIPA), of which Anadolu Agency is the global communication partner, continued with sessions.

Barikat Cyber Security Operations Center Director Mustafa Yılmaz, in his speech at the summit, emphasized that cyber security is a critical operation carried out 24/7 in protecting personal and corporate data. Stating that Barikat provides 24/7 monitoring service to more than 50 customers and that millions of lines of logs are produced daily through these customers, Yılmaz said that it is critical to convert these logs into threat visibility.

Yılmaz stated that approximately 60 thousand alarms come to the operation center monthly and said, “This means an average of 2 thousand per day.” This means the number of alarms is more busy on weekdays and less busy on weekends. When you look at it, it is necessary to examine this from a human perspective and make the right decisions and take the right steps. he said. Pointing out that the process is largely human-oriented in traditional security operation centers, Yılmaz explained that alarm intensity creates operational noise and loss of focus, and that human analysts may not always evaluate the same data with the same consistency.

– Correct positioning of people is important. Stating that they designed an artificial intelligence-supported digital workforce architecture based on this need, Yılmaz said that the structure can work in multiple customers’ data centers and can be managed and monitored from Barikat’s data center. Stating that the model includes a manager agent that manages the operation, an enrichment agent that enriches the data with different sources, an agent that analyzes, a visualize agent that visualizes events, and components that recommend actions to be taken against the threat, Yılmaz said, “Our artificial intelligence analyst, that is, our digital business partner, also performs the analysis in this way.

There are a few presentations about its analysis. First, we share the summary. We are trying to understand which tactic and technique Mitra attacked with, according to the Attack framework. Then we provide a summary. And below this summary, we make a visualization about the flow of the event. This is done entirely by artificial intelligence. he said. Emphasizing that Barikat’s approach is not to replace human analysts with artificial intelligence, Yılmaz said: What we are doing here is not to replace cyber security employees with an artificial intelligence solution or artificial intelligence technology and transfer the issue to artificial intelligence.

One of the biggest issues discussed today is how artificial intelligence will be positioned. But from our point of view, the issue is actually how people are positioned. In other words, artificial intelligence has started to enter all of our jobs in one way or another and will continue to do so. But here it is important to position the person correctly. – Institution-specific learning artificial intelligence architecture Yılmaz stated that Barikat’s digital workforce architecture provides speed, consistency and scalability together, and said that the system has institution-specific learning capability.

Yılmaz: The attack vectors faced by different sectors such as energy and finance differ from each other. For this reason, every institution needs to train artificial intelligence according to its own threat environment. We need to train artificial intelligence specifically for the institution. We provide this with institution-specific learning with the RAG database. Based on this learning, we can mature our decisions and implement cyber security operations.

made his assessment. Stating that the system constantly keeps itself updated with the feedback from analysts and customers, Yılmaz stated that the learning cycle continues throughout the operation. Yılmaz pointed out that the number of cyber attacks has increased with artificial intelligence and stated that on the attack side, automation and artificial intelligence-supported processes are now encountered in most cases.

Mustafa Yılmaz, We are currently monitoring with 20 people. Even if we put 100 people here, not much will change. We will not be able to shorten the times. So we won’t be able to scale the business. Our most important assistant here in scaling the business is our new colleague, the artificial intelligence system. he said.