AI in the SOC is outpacing workflow integration

At a glance

What this is: Horizons.ai’s SANS SOC survey shows AI adoption in security operations is running ahead of workflow integration, leaving visibility and outcomes as the main governance gaps.

Why it matters: For IAM and security teams, the issue is not whether AI is present in the SOC but whether it is embedded in decision-making, evidence handling, and measurable operating controls.

By the numbers:

• 79% of organisations are using AI or machine learning.
• Only 36% have integrated it into defined SOC workflows.
• 59% of leaders believe management prioritises SOC staffing.
• 24% of cyber leaders identify enterprise-wide visibility as the biggest barrier to SOC effectiveness.

Context

Security operations teams are increasingly adopting AI, but adoption alone does not make a SOC more effective. The real governance gap is workflow integration, where tools are present but not embedded into defined triage, investigation, and escalation paths. In practice, that means organisations can appear modern while still making decisions through fragmented processes and incomplete visibility.

This matters to identity security because SOC effectiveness depends on whether the organisation can reliably see and act on access behaviour, not just detect alerts. When AI sits beside the workflow instead of inside it, practitioners inherit a control gap between signal generation and response. The survey’s broader pattern suggests that executive confidence and practitioner experience are still diverging, which is common in mature-but-partial security programmes.

Key questions

Q: How should security teams introduce AI automation into SOC operations without breaking investigations?

A: Start with structured case management, not with broad automation. Define the investigation stages, ownership boundaries, and escalation criteria first, then automate repetitive enrichment and routing around that workflow. If the process is unclear before automation, the SOC only becomes faster at handling inconsistent decisions and incomplete evidence.

Q: Why does enterprise-wide visibility matter more than higher alert volume in the SOC?

A: Because alert volume only shows activity, while visibility determines whether the team can correlate identity, endpoint, cloud, and network signals into a defensible decision. Without that correlation, AI simply produces faster summaries of partial data, which can hide the real control gap.

Q: What are the signs that SOC AI is not fully operationalised?

A: Common signs include heavy manual triage, fragmented enrichment steps, limited linkage between alerts and identity behaviour, and pilot tools that never move into response ownership. If analysts still need multiple consoles to confirm access paths or movement patterns, AI is not yet part of the operating model.

Q: How should SOC leaders prove that AI is improving effectiveness, not just productivity?

A: Use measures that capture decision quality, containment speed, and evidence integrity, then compare them before and after AI adoption. If incident volume falls but investigation quality does not improve, the programme may be more efficient on paper than effective in practice.

Technical breakdown

Why AI adoption does not equal SOC integration

AI in the SOC usually starts as augmentation for alert triage, enrichment, and summarisation. That is not the same as workflow integration, which means the AI output is formally connected to case management, escalation rules, evidence collection, and analyst accountability. Without that wiring, AI can accelerate individual tasks while leaving the operating model unchanged. The result is a faster front end and a static control plane, where human teams still carry the burden of deciding what is trusted, what is verified, and what is acted on.

Practical implication: Treat AI outputs as workflow inputs only when the handoff, approval path, and evidence chain are explicitly governed.

Enterprise-wide visibility as a control dependency

Visibility in a SOC is not just about seeing more logs. It is the ability to correlate across identity, endpoint, cloud, and network activity quickly enough to support a decision. If a team lacks enterprise-wide visibility, AI models will simply summarise partial data more efficiently. That creates a false sense of maturity because the analytic layer improves while the underlying coverage gap remains. In identity-heavy environments, incomplete visibility especially weakens detection of privilege misuse, anomalous access, and compromised accounts.

Practical implication: Map visibility gaps across identity and infrastructure telemetry before assuming AI will improve detection quality.

SOC staffing, threat intelligence, and outcome metrics

The survey points to a recurring governance issue: leaders often believe resourcing and tooling are aligned while practitioners experience the opposite. That mismatch usually shows up when threat intelligence informs operations but not investment, or when incident volume is treated as the main success measure. Volume can rise when detection improves, so it is a weak proxy for effectiveness. Better SOC governance focuses on decision quality, alert fidelity, time to containment, and whether the team can prove the operating model is reducing risk rather than just generating activity.

Practical implication: Use outcome metrics that reflect containment quality and decision speed, not just alert counts or case volume.

NHI Mgmt Group analysis

AI adoption is not the same as operational maturity. The survey’s clearest signal is that organisations can deploy AI broadly while leaving the SOC workflow fundamentally unchanged. That creates a governance illusion: automation appears to be improving the function even when the decision chain, escalation logic, and evidence handling are still manual. Practitioners should treat integration depth, not tool presence, as the maturity marker.

Workflow integration is the real control plane. In a modern SOC, the important question is whether AI participates in defined operational steps or merely assists analysts informally. If outputs are not tied to case workflow, review thresholds, and auditability, AI becomes another source of noise rather than a control improvement. The practitioner conclusion is simple: embed AI where decisions are made, not where dashboards look advanced.

Visibility remains the foundation for SOC effectiveness. A SOC cannot govern what it cannot correlate across identity, cloud, endpoint, and network activity. This is also where identity security becomes inseparable from SOC design, because access behaviour is often the earliest indicator of compromise. The named concept here is the AI integration gap: the distance between deploying AI capabilities and proving they improve measurable SOC outcomes. Teams should close that gap before scaling the next automation layer.

Executive confidence and practitioner reality are diverging signals. When management and operators describe the same SOC differently, the organisation has a governance problem, not a perception problem. That gap usually reflects weak metrics, unclear ownership, and investment decisions that are not grounded in operational evidence. Practitioners should use this as a board-level warning that the reporting model may be flatter than the underlying risk profile.

Security operations metrics need to move beyond volume. Incident counts, ticket throughput, and tool coverage can all rise while control effectiveness stays flat. The better test is whether the SOC is improving decision quality and reducing dwell time in the contexts that matter most, including identity-driven investigations. Teams that cannot show this are measuring activity, not resilience.

From our research library:

• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

The AI integration gap is now a SOC governance issue, not a tooling issue. When teams adopt AI without embedding it into case handling and escalation, they improve task speed without changing control quality. That makes workflow design the primary decision point for practitioners planning their next SOC investment.

Identity data should sit closer to the SOC decision loop. The survey’s visibility problem is especially relevant where access behaviour, privileged actions, and account anomalies are early indicators of compromise. Practitioners should watch for programmes that add AI on top of weak telemetry coverage instead of fixing the underlying correlation problem first.

Outcome metrics will matter more as AI becomes operationalised. SOC leaders will increasingly need to show that AI improves decision fidelity, not just analyst throughput. Teams that cannot connect automation to measurable containment and investigation quality will struggle to defend their operating model at board level.

For practitioners

• Define AI-to-workflow handoffs Map exactly where AI can enrich, triage, summarise, or recommend actions, then tie each step to a named SOC workflow and accountable owner.
• Rebaseline visibility across telemetry sources Check whether identity, endpoint, cloud, and network data are sufficiently correlated to support investigations before expanding AI use cases.
• Measure outcome quality, not alert volume Replace volume-centric reporting with metrics that show containment speed, decision fidelity, and whether AI changes the quality of SOC action.
• Align staffing claims with practitioner evidence Compare leadership assumptions about SOC resourcing against analyst workload, queue depth, and escalation delay to surface governance mismatch.

Key takeaways

• AI in the SOC is creating a governance gap when tools are adopted faster than workflows are redesigned around them.
• The biggest problem is not the presence of AI but whether it is tied to visible, auditable SOC decisions.
• Teams should measure containment quality and decision fidelity before they assume automation is improving security.

Key terms

• SOC Workflow Integration: SOC workflow integration is the process of embedding tools, automation, and analyst tasks into defined operational steps with clear ownership and auditability. It matters because AI can increase speed without improving control unless the workflow shows who approved, reviewed, and executed each action.
• Visibility gap: A visibility gap is the point where a security team can no longer reliably see who has access to what, or why that access exists. In identity and data governance, it is a control failure because remediation depends on accurate ownership and current entitlement state.
• Decision Fidelity: Decision Fidelity is the degree to which a system’s output supports the correct operational choice, not just a plausible explanation. In security operations, high decision fidelity means the model’s classification leads to the right fix, the right priority, and the right escalation.
• Operational AI integration: Operational AI integration means AI is formally wired into business or security processes, not merely added as an assistant layer. In a SOC, that includes defined handoffs, review thresholds, and evidence retention so the organisation can explain why a machine-assisted action was taken.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, helps practitioners understand NHI governance, machine identity security, and the control decisions that shape modern security operations. It is a fit for security and identity teams that need a clearer operating model for trusted access and automation.