Notifications
Clear all
Topic starter
02/08/2026 12:01 pm
TL;DR: AI is pushing SOC design away from vertical, human-speed structures toward outcome, judgment, and execution layers, with automation handling 90% to 95% of Tier-1 work and accelerating response faster than legacy teams can sustain, according to torq. The real governance challenge is no longer adopting another tool, but redesigning operating models so human oversight and machine-speed execution are aligned.
NHIMG editorial — based on content published by torq: AI SOC org charts are shifting to machine-speed operations
By the numbers:
- If AI handles 90-95% of Tier-1 work, that means we’re cutting headcount?
- What was planned as a 30-week development cycle was executed in hours.
Questions worth separating out
Q: How should security teams govern AI-assisted actions in the SOC?
A: Security teams should treat AI-assisted SOC actions as policy-governed machine behavior, not informal automation.
Q: Why do AI-driven SOC workflows need stronger governance than traditional automation?
A: Traditional automation follows predefined rules, but AI-assisted workflows can change how a case is interpreted, prioritised, or escalated.
Q: What breaks when SOC automation is added to a legacy operating model?
A: Response becomes inconsistent.
Practitioner guidance
- Define outcome, judgment, and execution layers Map SOC work into these three layers so teams can separate strategy, oversight, and automated execution.
- Bound irreversible AI actions Create policy controls that require human approval before any containment, account disablement, or access revocation action that cannot be easily reversed.
- Inventory AI-driven workflows as governed NHIs Treat automation, orchestration, and agentic workflows as non-human identities with owners, scoped permissions, and audit requirements.
What's in the full article
Torq's full article covers the operational detail this post intentionally leaves for the source:
- The proposed AI SOC org chart with outcome, judgment, and execution layers in more implementation detail.
- John White's practitioner rationale for why security, rather than IT or data alone, may lead AI adoption in the SOC.
- The examples of how analysts may be displaced into higher-judgment roles and how that changes team design.
- The article's discussion of machine-speed threats and why traditional staffing models struggle to keep pace.
👉 Read torq’s analysis of how AI is reshaping SOC operating models →
AI SOC org charts: what changes when machine speed becomes the baseline?
Explore further
02/08/2026 1:07 pm
Machine-speed defence is now an operating-model problem. The article is right that AI cannot simply be bolted onto legacy SOC structures. Vertical teams built for queue management and shift coverage cannot reliably govern workflows that execute continuously and make decisions faster than human review cycles. The discipline shift is toward measurable outcomes, explicit judgment layers, and tightly bounded execution. Practitioners should treat SOC redesign as a governance redesign, not a tooling refresh.
A question worth separating out:
Q: How can analysts tell whether AI-driven SOC automation is actually working?
A: Look beyond alert volume and measure whether the platform produces accurate incidents, preserves tenant context, and shortens time to closure without creating rework. If analysts still need to reconstruct the story manually, the automation is reducing noise but not truly improving operational control.
👉 Read our full editorial: AI SOC org charts are shifting to machine-speed operations
