Notifications
Clear all
Topic starter
02/08/2026 12:31 pm
TL;DR: AI can already speed up SOC workflows through copilots, natural-language querying, and higher-fidelity alerting, but panelists cited by Anomali said those gains depend on modern, cloud-native infrastructure and data structures that legacy SOAR stacks cannot provide. The real shift is from analyst task execution to judgment, questioning, and agentic AI oversight.
NHIMG editorial — based on content published by Anomali: The Future of Security Isn’t AI vs. Analyst. It’s Both
Questions worth separating out
Q: How should security teams govern AI-assisted actions in the SOC?
A: Security teams should treat AI-assisted SOC actions as policy-governed machine behavior, not informal automation.
Q: Why do legacy SOC platforms limit the value of AI copilots and agents?
A: Legacy platforms often fragment data, slow retrieval, and hard-code response paths, which prevents AI from making useful decisions in context.
Q: What do security teams get wrong about agentic AI security tools?
A: The most common mistake is treating agentic AI security as an extension of an existing category such as NHI, endpoint, or DSPM.
Practitioner guidance
- Audit AI-readiness across SOC data and workflow layers Map where telemetry is stored, how quickly it can be retrieved, and which response actions are exposed to automation.
- Scope copilot access to least-privilege investigation rights Limit natural-language assistants to the cases, logs, and sources required for each analyst role.
- Define delegated authority for agentic workflows Assign explicit permissions, audit logging, and revocation rules before allowing AI systems to trigger containment, enrichment, or ticketing actions.
What's in the full article
Anomali's full post covers the operational detail this analysis intentionally leaves for the source:
- How the panel described cloud-native data architecture as the difference between useful AI and marketing claims
- The specific ways copilot workflows are reducing analyst effort in triage, reporting, and alert interpretation
- Why traditional SOAR patterns limit AI-driven response, including the constraints created by rigid playbooks
- How the discussion frames the shift from analyst execution to strategic oversight and prompt-driven investigation
👉 Read Anomali's analysis of AI-ready SOC infrastructure and analyst roles →
AI-ready SOC infrastructure: what it means for analyst teams?
Explore further
02/08/2026 1:28 pm
AI-ready infrastructure is now the prerequisite for meaningful security automation. The article shows that AI value in the SOC depends on modern platform architecture, not on attaching models to legacy workflows. Rigid SOAR logic and stale data structures turn AI into a decorative layer, while cloud-native pipelines can support contextual decisions at speed. For practitioners, the lesson is that automation maturity starts with infrastructure readiness.
A question worth separating out:
Q: How can organisations tell whether AI SOC ROI is actually improving?
A: Watch for sustained gains in MTTR, MTTD, alert coverage, and false positive reduction, not just a one-time spike after rollout. Pair those metrics with auditability of the investigation output and with analyst feedback on decision quality. If the numbers improve but trust falls, the model is not healthy.
👉 Read our full editorial: AI-ready SOC infrastructure is redefining analyst and agent roles
