Expert Insights That Drive Innovation and Progress
Discover expert perspectives to spark ideas and strengthen your expertise
The attacker's tooling has been generative for two years. The defender's tooling is finally catching up. The question is no longer whether to use AI in the SOC — it's which problems you let it touch first.
SOC teams are not failing at detection. They are failing at the next thirty minutes after detection — the part where someone has to read context, decide if it matters, and write the note that closes or escalates. This work compounds badly with volume, and volume has only gone one direction.
Language models, properly scaffolded, are the first tool that meets defenders at this exact bottleneck. They read fast. They write faster. They make consistent triage notes at 3am.
Three classes of work are durably appropriate for an AI layer in the SOC:
Auto-containment is the single most overpromised feature in vendor decks. Letting an LLM disable accounts, kill processes, or quarantine endpoints based on its own confidence is how you end up paging your CEO during a board meeting. Containment stays under human authority for the foreseeable.
The right tagline isn't 'AI-powered SOC.' It's 'analyst-powered SOC with the boring half removed.'
If you deploy an LLM agent into security workflows, you have created a new attack surface. Prompt injection from inside a ticket, a phishing email summary, or a log message is a real and demonstrated threat. Treat every model input as untrusted and design your tool permissions accordingly.
Wire a model into triage notes and alert enrichment, run it shadow for two weeks, then put it in front of analysts as a suggested-action panel they can accept or reject. Measure analyst time-to-decision, not model accuracy. The accuracy follows; the time savings are why you are doing this.
