AI in the SOC is cutting investigation time but widening the execution gap

At a glance

What this is: This survey report says AI is already reducing SOC investigation time, but most teams have not yet translated adoption into full workflow control or better visibility.

Why it matters: For IAM, NHI, and SOC teams, the finding matters because faster investigation without identity visibility and workflow integration can speed up response while leaving access-driven attack paths under-governed.

By the numbers:

• 60% of adopters of AI in the SOC have cut investigation time by at least 25%, according to Gurucul.
• The report is based on survey responses from 739 cybersecurity leaders worldwide, according to Gurucul.
• 87% of respondents are deploying, piloting or evaluating AI-powered SOC tools, according to Gurucul.
• Only 31% of respondents use AI-powered SOC tools across core detection and response workflows, according to Gurucul.

Context

AI in the SOC is the use of machine learning and automated analytics to help security teams detect, triage, investigate, and respond to alerts faster. The governance problem is not whether AI can shorten analysis time, but whether those gains are controlled well enough to preserve visibility, accountability, and consistent operational decision-making.

Gurucul's report shows that AI is being adopted because SOCs are under pressure from alert volume, burnout, and identity-driven attacks. That makes this a workforce, workflow, and control problem at the same time: speed is improving, but operational oversight is not keeping pace.

For IAM and identity security teams, the important question is how AI changes the handling of identity signals, lateral movement clues, and access anomalies inside SOC workflows. The report's core warning is that tool adoption alone does not close the execution gap if the surrounding identity and process controls remain fragmented.

Key questions

Q: Why do AI SOC tools reduce investigation time without fixing execution control?

A: AI can cut investigation time by accelerating triage and enrichment, but execution control depends on workflow design, identity visibility, and clear handoff ownership. If alerts remain fragmented across systems or analysts still have to stitch evidence together manually, the organisation gains speed without gaining consistent operational control.

Q: How should teams decide whether AI belongs in core SOC workflows?

A: Use core workflows when AI is tightly integrated into detection, investigation, and response, and when the team can trace what the system influenced. If AI remains a sidecar for summarisation or ad hoc enrichment, it can improve productivity but will not materially close the execution gap.

Q: What are the signs that SOC AI is not fully operationalised?

A: Common signs include heavy manual triage, fragmented enrichment steps, limited linkage between alerts and identity behaviour, and pilot tools that never move into response ownership. If analysts still need multiple consoles to confirm access paths or movement patterns, AI is not yet part of the operating model.

Q: What happens when AI speeds investigation but the SOC still lacks identity visibility?

A: The team can reach conclusions faster, but those conclusions may be based on incomplete evidence. That creates a risk of missed lateral movement, weak escalation decisions, and delayed containment, especially when identity-based attacks and phishing are already the main threat drivers.

Technical breakdown

Why AI speeds SOC investigation but not governance

AI improves investigation time by correlating large alert volumes, highlighting likely anomalies, and reducing the manual work of triage. In practice, that makes it a force multiplier for analysts dealing with identity-based alerts, phishing noise, and repeated enrichment steps. But investigation speed is only one part of operational control. If the SOC cannot see access behavior, lateral movement, or workflow handoffs clearly, AI may accelerate decisions without improving governance over those decisions. The technical issue is not model output quality alone. It is whether the SOC can preserve traceability from alert to analyst action to containment step.

Practical implication: Treat AI as an investigation accelerator, not as a substitute for identity visibility or response governance.

What the execution gap means for SOC workflows

The execution gap appears when AI is piloted or deployed, but not embedded across detection, investigation, and response workflows. That usually means the tool exists, yet the surrounding processes still depend on manual triage, disconnected enrichment, or analyst judgment that is not operationally consistent. In identity-heavy environments, this matters because access anomalies, privileged actions, and lateral movement signals are often spread across multiple systems. AI can surface those signals faster, but it cannot close workflow fragmentation by itself. The result is a partial control plane: fast insights, slow execution, and uneven handoff discipline.

Practical implication: Map where AI stops at insight generation and where your team still depends on manual workflow steps.

Why identity visibility remains the limiting factor

The report highlights a familiar SOC weakness: teams may understand the threat category, but still lack enough visibility into access behavior and lateral movement to act with confidence. In identity security terms, the SOC needs to connect alerts to who or what had access, what changed, and whether the behaviour fits an approved pattern. Without that connection, AI is working on incomplete telemetry. That is especially dangerous for identity-based attacks, where the primary evidence is often behavioural rather than signature-based. The technical limit is not the AI system itself. It is the quality and completeness of the identity data feeding it.

Practical implication: Prioritise identity telemetry that links access behaviour, privilege use, and movement patterns into SOC workflows.

Threat narrative

Attacker objective: The attacker seeks to turn identity compromise or access abuse into undetected lateral movement and delayed containment.

1. Entry often begins with social engineering or phishing, which the report identifies as the top concern for most security leaders.
2. Credential or access abuse then drives identity-based movement, but the report notes that many teams still lack visibility into access behaviour and lateral movement.
3. Escalation occurs inside overloaded SOC workflows when manual triage, fragmented tools, and analyst burnout delay recognition of the real attack path.
4. The impact is slower containment of identity-driven incidents even when AI is cutting investigation time, because the organisation cannot consistently operationalise the findings.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI is collapsing investigation time, but not the control model behind SOC decision-making. Faster triage changes analyst throughput, not the quality of the governance boundary around detection and response. When identity signals, access behaviour, and response ownership remain fragmented, the SOC may move faster without becoming more certain. The practitioner implication is that speed gains need control-plane redesign, not just more automation.

The real execution gap is workflow integration, not model adoption. A tool can be deployed, piloted, or evaluated and still leave the organisation dependent on manual enrichment, disconnected escalation, and inconsistent handoff paths. That is why the report's adoption numbers matter less than the 31% figure for core workflow use. The practitioner implication is that AI value emerges only when it is embedded into the operating model, not layered on top of it.

Identity visibility is now a SOC prerequisite, not a niche IAM concern. The report's emphasis on access behaviour and lateral movement shows that SOC teams cannot separate AI-assisted investigation from identity telemetry quality. If the SOC cannot connect an alert to a privilege path or account behaviour, it is analysing symptoms without context. The practitioner implication is to make identity data part of the SOC's default evidence set.

Gurucul's report points to an execution-capacity problem that IAM and SOC leaders must solve together. Alert fatigue, burnout, and fragmented tooling do not just slow analysts down; they also weaken the organisation's ability to govern access-driven threats consistently. AI can reduce investigation time, but the operating model still determines whether the organisation closes the loop. The practitioner implication is cross-functional governance between SOC, IAM, and identity architecture teams.

Identity-behaviour correlation is becoming the decisive SOC capability. The most important line in this report is not that AI speeds analysis, but that teams still cannot see access behaviour well enough. That means detection quality now depends on correlating identity, privilege, and movement patterns with alert data. The practitioner implication is to measure SOC maturity by evidence linkage, not just alert volume reduction.

What this signals

Identity telemetry is becoming the difference between AI-assisted insight and operational confidence. When security teams cannot see access behaviour and lateral movement clearly, AI can only accelerate partial answers. The practical signal for practitioners is to treat identity data as SOC evidence, not as a separate IAM concern.

The execution gap is a governance gap, not a feature gap. Adoption numbers may look strong, but the report shows that tools can sit outside core workflows and still leave analysts overloaded. That means programme owners need to measure whether AI is actually changing incident handling, not merely being evaluated.

Alert fatigue, burnout, and fragmented tooling are converging on the same problem: SOCs need better correlation between identity and behaviour. The organisations that close that correlation gap will get more value from AI than those that chase automation alone.

For practitioners

• Instrument identity telemetry for SOC use Connect access behaviour, privileged actions, and lateral movement signals to the SOC so AI investigations are grounded in identity context rather than generic alert data.
• Define the workflow boundary for AI assistance Document which triage, enrichment, escalation, and containment steps AI may support, and which decisions must remain under analyst or incident commander control.
• Reduce manual dependency in core response paths Replace repetitive investigation steps with deterministic integrations where possible, so analysts are not forced to move between disconnected tools during active incidents.
• Align SOC and IAM ownership on identity-driven alerts Create a shared operating model for alerts involving access anomalies, privileged use, and account behaviour so the right team can act without delay.
• Measure whether AI is used in core workflows Track where AI stops at pilots or sidecar use and where it is actually embedded in detection and response, because adoption alone does not prove operational control.

Key takeaways

• AI is already reducing SOC investigation time, but speed gains do not automatically translate into better operational control.
• The report's main warning is that identity visibility and workflow integration still lag behind AI adoption across SOC teams.
• Practitioners should measure AI by how deeply it is embedded into detection and response, not by whether it has been piloted or purchased.

Key terms

• Execution Gap: An execution gap exists when policy is defined correctly but cannot be carried out consistently in the target system. In identity governance, this usually appears where integrations are missing, evidence is fragmented, or lifecycle actions depend on human coordination instead of deterministic enforcement.
• Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.
• Alert Fatigue: Alert fatigue is the condition where a security team receives so many low-value alerts that important events become harder to notice. In monitoring programs, it usually signals poor rule tuning, weak prioritisation, or a mismatch between detection logic and operational reality.
• Workflow integration: Workflow integration is the connection of credential management with identity, HR, ticketing, and physical access systems so changes propagate consistently. The security value depends on whether the integration preserves approvals, revocation triggers, and log integrity rather than simply moving data faster.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.