Notifications
Clear all
Topic starter
01/08/2026 10:48 pm
TL;DR: AI now appears in 77% of security stacks, yet 72% of cybersecurity professionals remain neutral or lack confidence in their organisation’s ability to execute an AI security strategy, according to Panther. That gap makes visibility, accountability, reviewable reasoning, and data governance the immediate control priorities, not optional maturity goals.
NHIMG editorial — based on content published by Panther: AI governance challenges: what security teams need to solve first
By the numbers:
- GenAI plays a role in 77% of security stacks.
- 95% of cybersecurity professionals say AI can improve speed and efficiency.
- 72% are neutral or lack confidence in their organization's ability to execute an AI security strategy.
Questions worth separating out
Q: How should security teams govern AI-assisted actions in the SOC?
A: Security teams should treat AI-assisted SOC actions as policy-governed machine behavior, not informal automation.
Q: Why do AI tools create governance risk even when humans stay in charge?
A: AI tools create risk when they reshape the real decision path without changing formal ownership.
Q: What do security teams get wrong about human-in-the-loop controls for agents?
A: They often assume a manual approval step is the same as governance.
Practitioner guidance
- Inventory all AI touchpoints in security operations Map employee-facing AI use, vendor-embedded AI features, and SOC automation that makes or recommends decisions.
- Enforce approval gates for high-risk AI actions Require explicit human approval before AI suppresses alerts, triggers containment, or attributes activity to a specific actor.
- Tie vendor AI changes to re-review triggers Add contractual notification requirements for material AI behaviour changes, then route those changes through security review before they affect detection, response, or data access.
What's in the full article
Panther's full blog covers the operational detail this post intentionally leaves for the source:
- Contractual notification language for material AI behaviour changes after procurement
- Human-in-the-loop approval workflow patterns for suppression, containment, and attribution
- Audit trail fields needed to support SOC 2 and ISO 42001 review
- Practical examples of how SOC teams separate AI enrichment from autonomous response
👉 Read Panther’s analysis of AI governance challenges for security teams →
AI governance in the SOC: what security teams must fix first?
Explore further
01/08/2026 10:57 pm
AI governance in security operations is becoming an identity problem as much as a model problem. When AI systems can act inside SOC workflows, they begin to resemble non-human identities that need explicit ownership, permission boundaries, and revocation logic. That shifts the governance question from whether the model is useful to whether its access is bounded and reviewable. The practical conclusion is that AI oversight belongs alongside IAM and PAM, not outside them.
A question worth separating out:
Q: Who is accountable when AI suppresses or mishandles an alert?
A: Accountability sits with the organisation that defined, approved, and operated the workflow, not with the model itself. If no human decision point exists, the failure becomes a governance failure as well as an operational one, and auditors will look for the missing control.
👉 Read our full editorial: AI governance challenges for security teams: what to solve first
