Topic starter
02/08/2026 11:57 am
TL;DR: Attackers reach lateral movement in under 48 minutes while average alert investigation takes 70 minutes, Torq reports, and 40% of alerts are never investigated. SOC workflows need bounded autonomy for routine containment because human queues leave too much exposure time.
Editorial analysis by NHI Mgmt Group, based on content published by torq: “How AI Should Actually Work in Your SOC”.
By the numbers:
- Attackers achieve breakout from initial access to lateral movement in under 48 minutes.
Key questions
Q: Why do slow alert investigations create outsized risk in high-volume SOCs?
A: Slow investigations matter because time is itself a security variable.
Q: What are the signs that AI in the SOC is only assisting, not acting?
A: The clearest sign is that AI produces summaries, recommendations, or chat responses, but analysts still have to execute every containment step manually.
Q: What breaks when SOC response still depends on human approval at every step?
A: The response loop breaks because the attacker can complete discovery, exploitation, and lateral movement before analysts finish coordination.
Practitioner guidance
- Define autonomy boundaries by case severity Separate low-risk, repetitive alerts from high-severity or novel incidents, and permit autonomous action only where the response path is already well understood.
- Connect IAM actions to SOC runbooks Make session revocation, account disablement, and access blocking executable steps in the same workflow that handles triage and containment.
- Measure containment speed, not just detection speed Track time from alert receipt to containment action, alongside investigation backlog and uninvestigated alert rates, so automation success is visible.
Bottom line: The central risk is a timing mismatch: attacker breakout is faster than human investigation, and that turns ordinary alert backlogs into exposure windows.
Glossary terms: AI-Powered SOC, Human-on-the-loop, Response-gap compression, Autonomous remediation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:04 pm
AI-autonomous response is becoming the relevant control boundary. The article shows that the decisive problem is not whether AI can summarize alerts, but whether it can complete response actions before attacker movement reaches lateral spread. In governance terms, this shifts the control boundary from investigation support to executable containment. Practitioners should evaluate autonomy as an operational control, not as a productivity feature.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that AI systems will initiate 50% of all service requests by 2030, driven largely by agentic AI.
A question worth separating out:
Q: How should teams govern autonomous response so it stays auditable and safe?
A: Teams should define which incident classes can be handled automatically, which actions require escalation, and what evidence must be retained for every machine decision. That means configuring clear guardrails, human oversight thresholds, and traceable action logs. Autonomy is only defensible when it is bounded, explainable, and reversible.
👉 Read our full editorial: AI autonomous SOCs are reshaping the response gap in 2026