Human-centered AI is reshaping the modern SOC

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's research: AI is changing the SOC by reducing repetitive work, redirecting analysts toward higher-value tasks, and accelerating expectations for autonomous operations.

Why it matters: This matters because SOC leaders have to decide where automation ends, where human oversight stays, and how to keep detection and response accountable as AI becomes operationally central.

By the numbers:

• The survey covered 491 security leaders and analysts.
• 96% of security leaders plan no headcount reductions from AI adoption.
• 80% of analysts expect autonomous SOCs to become the norm within three to five years.
• 35% of analysts report burnout.

Context

SOC leaders are trying to absorb rising alert volume, constrained staffing, and analyst burnout without weakening detection and response. In that environment, AI is not just an efficiency layer, it is a governance issue because it changes how work is distributed, reviewed, and acted on inside the security operations center.

The article's central finding is that security teams want AI to remove repetitive work, not replace analysts. That makes the primary identity question one of human IAM for analysts inside an operational system: who can automate what, who remains accountable for decisions, and when does human review still need to gate action?

The article also points to a near-term shift toward autonomous SOC behaviour, which raises the bar for trust, transparency, and measurable effectiveness. The programme challenge is to keep analyst judgment in the loop even as detection, triage, and response become more machine-driven.

Key questions

Q: How should security teams use AI in the SOC without weakening human oversight?

A: Use AI for enrichment, clustering, summarisation, and draft recommendations, but keep humans responsible for containment decisions that affect access, identity state, or business-critical workflows. The safest model is one where AI reduces triage friction while analysts retain authority over irreversible actions. If the output cannot be explained or traced, it should not be allowed to drive response.

Q: What are the signs that security analyst burnout is affecting SOC performance?

A: The clearest signs are exhaustion, cynicism, and repeated mistakes. Exhausted analysts may struggle to sleep, focus, or recover between shifts. Cynicism often shows up as reduced trust, low engagement, and declining enthusiasm. Repeated errors are especially concerning because they suggest the analyst is no longer able to apply normal attention and recall under pressure.

Q: How can organisations tell whether AI SOC ROI is actually improving?

A: Watch for sustained gains in MTTR, MTTD, alert coverage, and false positive reduction, not just a one-time spike after rollout. Pair those metrics with auditability of the investigation output and with analyst feedback on decision quality. If the numbers improve but trust falls, the model is not healthy.

Q: What happens when autonomous SOC workflows replace human-paced decisions?

A: The oversight model changes from analyst review to governance over machine-timed action. That means teams must know which steps are still human-approved and which are delegated to automation, because once the workflow becomes autonomous, review cadences built for manual operations no longer match the pace of execution.

Technical breakdown

Why repetitive SOC work becomes a control problem

Repetitive alert handling is not just a productivity drag. It creates a control-quality problem because analysts spend less time on threat hunting, validation, and escalation judgment, which are the steps that convert raw telemetry into defensible response. When 44% of analysts say they spend too much time on repetitive tasks, the risk is that manual triage becomes a bottleneck rather than a safeguard. The deeper issue is that operational overload changes how reliably humans can verify decisions before action. Practical implication: reduce low-value queue work before asking analysts to supervise higher-risk automation.

Practical implication: reduce low-value queue work before asking analysts to supervise higher-risk automation.

Human-centered AI in the SOC still depends on accountable decision gates

Human-centered AI does not mean AI runs the SOC without oversight. It means AI handles routine classification, summarisation, and prioritisation while humans retain responsibility for escalation, containment, and exception handling. That distinction matters because security operations are accountable systems, not just throughput systems. If AI is tuned only for speed, it can compress review windows and make it harder to explain why one alert was escalated and another suppressed. Practical implication: define which SOC decisions remain human-authorised even when AI prepares the recommendation.

Practical implication: define which SOC decisions remain human-authorised even when AI prepares the recommendation.

Autonomous SOC adoption changes the operating model, not just the tooling

The move toward autonomous SOCs changes the architecture of response. Instead of humans completing every workflow step, AI increasingly determines which signals matter, which playbook branch to follow, and when to trigger downstream actions. That shifts the control question from analyst productivity to governance over machine-timed decisions. The article suggests this transition is already expected by most respondents, which means teams need to understand where automation stops being assistance and starts becoming delegated authority. Practical implication: map each SOC workflow to the point where machine decision-making would require explicit governance review.

Practical implication: map each SOC workflow to the point where machine decision-making would require explicit governance review.

NHI Mgmt Group analysis

AI in the SOC is becoming a governance model, not a point product feature. The survey shows that most teams want AI to absorb repetitive work while preserving headcount and analyst judgment. That means the real design problem is decision authority, not staffing reduction. The organisation that treats AI as an efficiency layer only will miss the harder question of how detection quality changes when machine recommendations shape analyst behaviour. The practitioner conclusion is that SOC governance must now cover who decides, who reviews, and which actions remain human-authored.

Analyst burnout is now a security control issue. When repetitive work consumes analyst time, the SOC loses not just morale but verification depth. That weakens the quality of triage, the consistency of escalation, and the ability to pursue proactive hunting. In other words, operational fatigue becomes a measurable degradation in control execution. The practitioner conclusion is that reducing manual load is part of improving security outcomes, not a separate productivity initiative.

Autonomous SOC expectations create an assumption collapse around human-paced oversight. Access review and analyst supervision models were designed for workflows where humans could inspect, validate, and certify outcomes before action closed. That assumption fails when AI begins to drive operational timing and branch selection inside the SOC. The implication is not merely to add more review, but to rethink where accountability can still be attached when decisions are increasingly machine-timed.

Trust in SOC AI will be earned through evidence, not vendor narrative. Respondents prioritise solution effectiveness, transparency, and third-party validation, which shows that SOC teams are already sceptical of black-box claims. That is a healthy shift because operational AI can only be adopted safely when its behaviour is observable and its outputs are measurable. The practitioner conclusion is that evaluation must focus on performance proof and explainability, not feature density.

The modern SOC is moving from reactive triage toward governed automation. The article points to more time for threat hunting and more planned investment in incident response, which is the right direction if the organisation can keep decision quality intact. This is where human-centered AI is most valuable: not by replacing the analyst, but by making the analyst more available for judgment-heavy work. The practitioner conclusion is to treat AI adoption as an operating-model change with governance consequences.

From our research library:

• Companies using AI governance put over 12 times more AI projects into production, according to a Databricks report.
• Read next: Agentic AI Identity Guide

What this signals

Human-centered AI is best understood as control redistribution. In the SOC, AI that removes repetitive work changes where human judgment is needed most. The programme question is no longer whether AI can assist, but which decisions must remain visibly accountable when automation starts shaping response paths.

Analyst capacity becomes a security variable. Burnout and task saturation reduce the quality of triage, hunting, and escalation, so SOC maturity now depends on protecting analyst attention as deliberately as it protects infrastructure. Organisations using AI governance put over 12 times more AI projects into production, according to the 2026 Infrastructure Identity Survey, which suggests the governance advantage comes from structure, not speed alone.

For practitioners

• Reassign repetitive SOC work first Use AI to absorb repetitive alert handling, enrichment, and summarisation so analysts can spend time on threat hunting and escalation judgment.
• Keep human approval on high-risk response actions Define which containment and remediation steps remain analyst-authorised even when AI prepares recommendations or prioritisation.
• Measure AI on operational effectiveness, not claims Evaluate tools against demonstrable performance, transparency into model behaviour, and third-party validation before widening deployment.
• Build a governance path for autonomous SOC workflows Map the response steps where machine-led decisions would move from assistance to delegated authority and require formal review.
• Redirect saved analyst time into higher-value work Plan for the capacity AI creates by investing it in incident response, proactive defence, and mentoring rather than leaving it unclaimed.

Key takeaways

• AI in the SOC is less about shrinking teams than about changing how analyst time is used and how decisions are authorised.
• Burnout and repetitive work degrade security outcomes because they reduce the quality of triage, hunting, and escalation.
• The strongest adoption test is whether AI improves operational effectiveness while preserving transparent, accountable human oversight.

Key terms

• Human-centered AI: Human-centered AI is an operating approach in which the person remains responsible for the decision and the machine provides context, prioritisation, or recommendation. The goal is not to replace judgement, but to make security decisions more consistent, traceable, and defensible.
• Autonomous SOC: A security operations model in which software can move beyond recommendation and begin influencing or triggering response actions. In practice, this means the SOC must govern decision boundaries, auditability, and human override paths as tightly as it governs alerts and access.
• Analyst Burnout: Analyst burnout is the point at which repetitive security work, high alert volume, and low role variety reduce judgement and performance. In SOC programmes it becomes an operational risk because tired teams miss context, over-rely on automation, and respond more slowly to subtle abuse.
• Decision Authority: The ability of a system to make and carry out an operational choice without a human making that choice first. In identity and fraud governance, decision authority matters because it changes who owns the outcome, how it is audited, and when a human must intervene.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.