TL;DR: The central theme being alert overload, complexity and the need to use AI practically rather than as hype in Stellar Cyber’s RSAC 2026 podcast features Sumitomo Chemical CISO Erwin Eimers on how AI is reshaping security operations, according to Stellar Cyber. The governance issue is no longer whether AI can assist the SOC, but how teams control its scope, workflow fit and decision quality.
At a glance
What this is: A Stellar Cyber podcast episode from RSAC 2026 discusses how AI is being applied in security operations and why SOC teams are looking for practical scale rather than abstract promise.
Why it matters: It matters because IAM, SOC and cloud security teams increasingly need to govern AI-assisted operations as part of a broader control environment, especially where identity, alert triage and workflow automation intersect.
Context
Security operations teams are under pressure from alert overload, fragmented tooling and the widening gap between the speed of attacks and the speed of human triage. AI is being introduced to narrow that gap, but it also creates a governance question: which decisions are being accelerated, which are being delegated, and where human approval still has to remain in the loop.
The article is framed around a CISO-level view of how AI is being used in real enterprise security operations, not a product deep dive. That makes the core issue one of operating model design, where automation, analyst oversight and workflow trust have to stay aligned.
Key questions
Q: How should security teams use AI in the SOC without losing human control?
A: Use AI to remove repetitive work, enrich alerts, and accelerate triage, but keep humans accountable for escalation, containment, and exception handling. The right model is human-centred automation, where AI expands analyst capacity without becoming the final decision-maker for high-risk actions. That requires explicit approval gates, audit trails, and ownership for every automated step.
Q: When does alert overload become a governance problem rather than a tooling problem?
A: Alert overload becomes a governance problem when teams cannot separate signal from noise fast enough to contain active risk. If false positives dominate analyst time, the issue is not just volume. It is also control design, data quality, and response ownership. Mature programs measure time to triage, time to contain, and whether alerts map to actionable decisions.
Q: What should organisations do first before giving AI more SOC authority?
A: Start by mapping the identities, permissions and approval paths behind the AI workflow. If the system can query tools or trigger actions, those rights need explicit ownership, least privilege and reviewable boundaries before wider delegation is allowed.
Q: Should AI replace analysts in security operations or support them?
A: It should support them. AI is best used to compress triage, enrich context and propose actions, while analysts retain responsibility for interpretation, exception handling and escalation decisions that require judgement or business context.
Technical breakdown
How AI changes SOC triage mechanics
AI in the SOC is usually applied to first-pass sorting, correlation and summarisation of alerts, not to fully autonomous defence. The technical shift is from manual queue handling to machine-assisted prioritisation, where models can cluster related events, enrich context and propose next actions. That reduces analyst fatigue, but it also means the quality of the input data, detection logic and case context matters more, because errors can propagate quickly through the workflow. The real mechanism is decision compression: fewer alerts reach humans, so the remaining cases must be more trustworthy and better explained. See the SOC Guide.
Practical implication: Treat AI-assisted triage as a control layer that needs observable decision quality, not as a substitute for detection engineering.
Why alert overload creates governance debt
Alert overload is not only an operational nuisance. It creates governance debt when teams begin suppressing, auto-closing or routing findings without enough visibility into why the system made those choices. In practice, this is where AI can either reduce friction or make blind spots harder to see. If the SOC cannot explain how alerts were filtered, correlated or prioritised, then the programme has weakened auditability and increased dependence on tacit analyst judgement. For identity-heavy environments, that matters because compromised accounts and abnormal access patterns often surface first as noisy, low-confidence signals.
Practical implication: Measure whether AI is reducing noise without hiding the access anomalies that matter most.
Where AI-assisted security operations meet identity governance
SOC automation increasingly depends on identities, whether those are analyst accounts, service accounts, API tokens or agent identities driving workflows. That makes governance of permissions, traceability and approval paths part of the security operations design, not a separate IAM conversation. If an AI-supported workflow can query tools, enrich cases or trigger actions, the operating model must define what identity it uses, what it can access and how exceptions are recorded. This is where [[L7|agentic AI security policy]] becomes relevant, because the question is not only what AI sees, but what it is allowed to do on behalf of the SOC. See the Agentic AI Security Policy Template.
Practical implication: Map every AI-enabled SOC workflow to a named identity, a bounded permission set and a reviewable approval path.
NHI Mgmt Group analysis
AI in security operations should be judged by governance quality, not by volume of automation. The central question is whether AI improves decision integrity, or simply accelerates the same weak processes at higher speed. Security teams do not need more automated actions if those actions cannot be explained, audited or contained. Practitioners should therefore treat AI-assisted SOC capability as an operating model issue first and a tooling issue second.
Alert overload is now a control failure as much as an operational burden. When teams cannot triage at the rate required by the environment, they begin to ration attention, which creates predictable blind spots in compromised-account detection and response. The implication is that security operations design must account for human limits explicitly, rather than assuming analysts can absorb unlimited noise.
Identity is the hidden control plane of AI-enabled SOC workflows. Once AI systems query data, enrich incidents or trigger response actions, they depend on service accounts, API credentials and delegated permissions. That means the governance of machine and agent identities becomes part of the SOC architecture, not an adjacent IAM concern. Teams that do not inventory those identities will struggle to prove who or what performed a security action.
Decision compression: the real risk is not just faster analysis, but fewer visible decision points. AI can collapse multiple analyst steps into one opaque recommendation, which improves speed but can weaken oversight if the rationale is not retained. This is where security leaders need to insist on traceability, bounded authority and rollback paths. The practical conclusion is straightforward: faster is only better when the path to each action remains inspectable.
The next SOC maturity step is controlled AI delegation, not autonomous trust. Mature programmes will separate summarisation, recommendation and execution so that each layer has different permissions and different review standards. That distinction matters because the goal is not to let AI replace analysts, but to make security operations scalable without losing governance. Practitioners should design for delegated assistance, not blanket autonomy.
From our research library:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
- Read next: SOC Guide
What this signals
AI-assisted security operations will increasingly be judged by traceability. Teams will be expected to show not only that automation reduced noise, but also that the reasoning behind prioritisation and response remains inspectable. That makes workflow audit trails and permission boundaries part of SOC design, not optional documentation.
Agent identity will become a practical SOC governance issue. As AI systems move from summarising cases to touching tools and actions, their identities, privileges and offboarding must be governed like any other privileged actor. Without that discipline, automation can outgrow the controls meant to constrain it.
For practitioners
- Define AI-assisted SOC decision boundaries Separate summarisation, recommendation and execution so that each workflow has a clearly bounded authority level and documented human review point.
- Inventory every identity used by security automation Track analyst accounts, service accounts, API tokens and any agent identities that can enrich cases or trigger response actions.
- Measure decision quality, not just alert volume Review false positives, false negatives, escalation accuracy and the proportion of cases where the model rationale is preserved for audit.
- Keep AI workflows tied to response runbooks Ensure any AI-enabled action can be traced back to an approved runbook so the SOC can explain why the action was taken.
Key takeaways
- AI is being used to scale security operations, but the real question is whether it improves governance quality or simply accelerates existing weaknesses.
- Alert overload turns into a control problem when teams cannot explain which cases were filtered, suppressed or escalated by automation.
- The key design choice is to bound AI authority, preserve audit trails and treat machine and agent identities as part of the SOC operating model.
Related NHI Mgmt Group resources: SOC Guide · Agentic AI Security Policy Template · MDR Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | AI-enabled SOC workflows depend on tightly scoped permissions and traceable delegated access. |
| Recommendation — Apply PR.AA-05 to bound AI-enabled SOC permissions and document who or what can trigger actions. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | SOC automation and agent workflows should not inherit broad permissions by default. |
| Recommendation — Enforce AC-6 so AI-assisted workflows operate with the minimum permissions needed for each task. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI systems that enrich or act on cases can misuse delegated identity and privilege if controls are weak. |
| Recommendation — Limit delegated privileges and monitor agent action scope to prevent identity and privilege abuse. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Automation identities used by SOC tooling can become overprivileged if not governed as NHIs. |
| Recommendation — Review automation identities for overprivilege and remove access that the workflow does not require. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Compromised identities and tool access are the paths that make SOC automation dangerous when abused. |
| Recommendation — Map suspicious automation activity to credential access and lateral movement tactics in your detections. | ||
Key terms
- Security Operations Automation: The use of software to classify, route, or summarise security work with limited manual intervention. Automation can improve speed and consistency, but it does not remove accountability. The control question is whether the system is assisting human decisions or acting as a hidden decision layer.
- Alert Overload: Alert overload occurs when a security team receives more alerts than it can realistically investigate within required timeframes. The condition creates backlog, missed alerts, and inconsistent triage quality. It is often a capacity problem as much as a tooling problem, because the volume of telemetry outpaces available analyst time.
- Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
- Decision Compression Risk: Decision compression risk is the governance problem that appears when automation shortens the time available for human review, challenge, and escalation. In SOC operations, faster triage can improve throughput, but it can also hide weak judgement if the control path is not designed for human oversight.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for practitioners building governance around machine identities, delegated access and AI-enabled workflows.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org