Thousands of IT leaders, cybersecurity experts and Splunk users from around the world converged on Denver, Colorado, for Splunk.conf26, the company’s flagship annual conference, held September 14–17, 2026, at the Colorado Convention Center. Among them was Bogdan Ghiță, Deputy Presales Director at Datanet Systems, who assessed the latest announcements and technology roadmap through the lens of the challenges facing organizations in Romania.

 

Beyond the advances in artificial intelligence, cybersecurity and observability, the conference signaled a fundamental shift in approach: technology must help organizations not only detect and resolve incidents, but also anticipate and prevent the issues that directly impact business performance. The solutions unveiled by Splunk address tangible challenges faced by organizations across virtually every industry.

For Bogdan Ghiță, the event offered both a clear view of Splunk’s strategic direction and practical, real-world use cases that mirror the challenges Romanian companies face these days.

 

„One of the most clearly defined themes, in my view, is the transition from the traditional model, where the focus is on reducing MTTD and MTTR, detecting and resolving issues as quickly as possible after they occur, to a predict-and-prevent model. By combining AI, automation and the correlation of vast amounts of data, Splunk aims to surface early warning signals, automate the initial analysis and give teams the context they need to act before an incident has any real impact,” says Bogdan Ghiță.

Why rapid detection is no longer enough?

For years, the performance of IT and security teams has been measured by two core metrics: time to detect and time to resolve. Reducing both remains important, but doing so does not eliminate the business impact of an incident.

When an e-commerce platform goes down for just ten minutes, even a swift response can translate into hundreds of lost orders. When a bank detects fraud only after a transfer has been completed, a fast investigation offers no guarantee that the funds will be recovered.
In Denver, Splunk showcased an approach in which AI, automation and advanced analytics work together to detect anomalies early, correlate seemingly unrelated events and anticipate service degradation before it occurs.

Consider a retailer operating hundreds of stores. A single database issue can trigger a cascade of alerts across dependent applications, payment systems and POS terminals. In a traditional model, the IT team must sift through a flood of notifications to pinpoint the common root cause.

With Splunk IT Service Intelligence (ITSI), these alerts can be consolidated into a single, actionable incident, while AI capabilities help explain the probable cause, surface supporting evidence and recommend remediation steps. By tracking key performance indicators over time, teams can even identify service degradation before it escalates into an outage.

This approach closely aligns with Datanet Systems’ own strategy for its end-to-end IT infrastructure monitoring services: delivering visibility across the entire business service, rather than into isolated infrastructure components.

When the application is up, but the business is losing revenue

Another key theme of the conference was the extension of observability beyond IT infrastructure to the actual end-user experience.

Picture a customer browsing an online store, selecting products, adding them to the cart and proceeding to checkout. They click “Place Order,” but the transaction fails to complete. The servers are running, the application is available, and traditional monitoring tools may not flag any critical issue. For the business, however, the outcome is a lost sale.

Splunk Digital Experience Analytics and Real User Monitoring enable organizations to map the customer journey, pinpoint exactly where users drop off and correlate their experience with application performance. With Application Performance Monitoring and Distributed Tracing, teams can trace the issue all the way to the backend service causing the error or latency. In addition, Synthetic Monitoring can routinely simulate critical workflows such as login, payment and checkout, identifying issues before they reach real users.

Integration with Cisco ThousandEyes further extends this visibility to network connectivity and end-to-end network paths.

For retailers, banks, telecom operators and digital service providers, the difference is substantial. Monitoring no longer answers only the question “Is the application up?” but also “Can customers accomplish what they set out to do, and how are technical issues affecting business outcomes?”.

 

Cybersecurity: fewer alerts, greater context

The same shift in mindset is reshaping cybersecurity. A Security Operations Center can receive thousands of alerts a day, many of them triggered by legitimate activity or low-risk events. Investigating each one drains time and resources, while genuine threats risk being buried in the noise.

With Splunk Enterprise Security, AI-assisted investigations and SOAR automation, teams can correlate events, accelerate initial triage and prioritize the threats that demand immediate action.

One use case highlighted at the conference was financial fraud detection. Viewed in isolation, a transaction may appear perfectly legitimate. The picture changes, however, if a dormant account was reactivated shortly before the transfer, the password and authentication method were changed, and the session originated from an unrecognized device. Splunk can correlate data from transaction systems, authentication applications, security infrastructure and other sources to reveal patterns that would otherwise go unnoticed.

For financial institutions, payment processors and insurers, this approach can accelerate fraud detection and help reduce losses. Importantly, AI is not intended to remove human experts from the decision-making process. AI agents can take on much of the repetitive analysis and investigation work, equipping analysts with the context, evidence and recommendations they need, while validation and critical decisions remain firmly under human control.

 

AI is becoming part of operations. But who is monitoring the AI?

One of the most compelling developments unveiled at Splunk .conf26 focuses on how organizations use artificial intelligence itself. As AI agents move from pilot projects into production workflows, new questions emerge: How can we verify that an agent is performing as intended? Which systems is it accessing? How do we prevent sensitive data from being exposed? And how do we keep the cost of using AI models in check?

Splunk Agent Observability applies proven application monitoring principles to AI agents, delivering visibility into execution flows, interactions with models and external tools, performance and resource consumption.

Consider an AI agent deployed in customer service that, following an update, begins making more calls to external models. Response times increase, and so do costs. By monitoring execution and token consumption, the organization can quickly identify the issue and optimize the agent’s performance.

At the same time, guardrails help prevent undesirable behavior, such as the exposure of personal data, misuse of tools or execution of high-risk actions. This is a significant step forward for companies looking to embed AI into their day-to-day operations: AI agents must become as observable, controllable and predictable as any other business-critical application.

 

Bringing AI to the data, not the other way around

 

For many organizations, the biggest barrier to AI adoption is not a lack of use cases, but the inability to move sensitive data to external cloud services. Banks, public institutions and critical infrastructure operators must comply with stringent requirements for data security, confidentiality and control.

One of the headline announcements at Splunk .conf26 tackles this challenge head-on. Cisco AI POD for Splunk, developed as part of the Cisco Secure AI Factory with NVIDIA initiative, enables organizations to run Splunk AI capabilities on their own infrastructure, including private cloud and fully air-gapped environments. The solution combines Cisco infrastructure, NVIDIA GPU acceleration and AI-optimized software into a pre-validated architecture for deploying AI models and agents within Splunk Enterprise.

In practice, a bank can leverage AI agents to investigate security incidents and correlate data across internal systems without sending sensitive information to an external AI service. Organizations can run AI models on-premises while retaining full control over their infrastructure and the data being processed.

For Datanet Systems, this development is particularly significant, as it brings together two areas of deep company expertise – Cisco infrastructure and Splunk platforms – and aligns with the company’s strategic focus on Private AI. As a result, conversations with customers can move beyond deploying a software solution toward building an integrated AI infrastructure tailored to each organization’s security requirements and operational needs.

 

More data doesn’t have to mean higher costs

Another challenge common to many organizations is the rapid growth in data volumes. Banks, telecom operators, energy companies and public institutions generate and retain vast amounts of data for security, audit, compliance and investigation purposes. Yet not all of this data needs to be accessed daily, nor does all of it warrant the same level of performance and storage cost. With Machine Data Lake and Federated Search, Splunk is enabling organizations to keep data available for analysis without having to permanently index everything in the platform.

A financial institution, for example, may need to retain logs for extended periods, even though day-to-day investigations rely primarily on recent data. The ability to query archived data or data stored in other platforms, including AWS S3 and Snowflake, can streamline investigations and optimize costs.

This capability becomes even more critical as AI adoption scales, since agents require access to the richest possible context without all data having to be consolidated into a single system. In parallel, the deepening integration between Cisco and Splunk, including through Cisco Data Fabric, is designed to make it easier to correlate insights across infrastructure, networks, applications and security systems.

 

Key takeaways from Splunk.conf26

From Datanet Systems’ perspective, the key takeaway from the conference is that Splunk’s evolution addresses real-world business challenges: fraud prevention, the availability of critical services, cybersecurity and the governance of AI applications.

“I believe conversations with customers should start with the big challenges, the ones that have a real business impact, and then identify the Splunk components that can help address them. Whether it’s preventing fraud, ensuring the availability of critical services or reducing security risk, what matters is demonstrating how data, AI and automation can deliver tangible results,” emphasizes Bogdan Ghiță, Deputy Presales Director, Datanet Systems.

For Datanet Systems, Splunk’s new capabilities, combined with its increasingly close integration with the Cisco ecosystem, create new opportunities to help customers move beyond traditional monitoring and reactive incident response toward proactive problem anticipation, prevention and operational optimization. To learn more about Splunk solutions, contact us at sales@datanets.ro.