Topic starter
01/08/2026 9:00 pm
TL;DR: The 2026 SANS SOC Survey finds 79% of organisations using AI or machine learning, yet only 36% have integrated it into defined SOC workflows, while 24% of cyber leaders still name enterprise-wide visibility as their biggest barrier, according to Horizons.ai. The gap between adoption, workflow design, and measurable outcomes is now the central SOC governance problem.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “2026 SANS SOC Survey Insights: A Decade of Evolution in Cyber Defense”.
By the numbers:
- 79% of organisations are using AI or machine learning.
- Only 36% have integrated it into defined SOC workflows.
- 59% of leaders believe management prioritises SOC staffing.
Key questions
A: Start with structured case management, not with broad automation.
Q: Why does enterprise-wide visibility matter more than higher alert volume in the SOC?
A: Because alert volume only shows activity, while visibility determines whether the team can correlate identity, endpoint, cloud, and network signals into a defensible decision.
Q: What are the signs that SOC AI is not fully operationalised?
A: Common signs include heavy manual triage, fragmented enrichment steps, limited linkage between alerts and identity behaviour, and pilot tools that never move into response ownership.
Practitioner guidance
- Define AI-to-workflow handoffs Map exactly where AI can enrich, triage, summarise, or recommend actions, then tie each step to a named SOC workflow and accountable owner.
- Rebaseline visibility across telemetry sources Check whether identity, endpoint, cloud, and network data are sufficiently correlated to support investigations before expanding AI use cases.
- Measure outcome quality, not alert volume Replace volume-centric reporting with metrics that show containment speed, decision fidelity, and whether AI changes the quality of SOC action.
Bottom line: AI in the SOC is creating a governance gap when tools are adopted faster than workflows are redesigned around them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:07 pm
AI adoption is not the same as operational maturity. The survey’s clearest signal is that organisations can deploy AI broadly while leaving the SOC workflow fundamentally unchanged. That creates a governance illusion: automation appears to be improving the function even when the decision chain, escalation logic, and evidence handling are still manual. Practitioners should treat integration depth, not tool presence, as the maturity marker.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How should SOC leaders prove that AI is improving effectiveness, not just productivity?
A: Use measures that capture decision quality, containment speed, and evidence integrity, then compare them before and after AI adoption. If incident volume falls but investigation quality does not improve, the programme may be more efficient on paper than effective in practice.
👉 Read our full editorial: AI in the SOC is outpacing workflow integration