Topic starter
02/08/2026 11:51 am
TL;DR: Based on 450 CISOs and security leaders across four countries, 94% of teams use AI in the SOC, 80% say it adds complexity, and only 35% let AI handle triage, according to torq. The governance problem is no longer adoption, but deciding where automation can operate safely without weakening control.
Editorial analysis by NHI Mgmt Group, based on content published by torq: “RSAC 2026: Oops, We Did It Again.”.
By the numbers:
- 94% of teams use AI in the SOC.
- 80% say AI is adding complexity, not reducing it.
Key questions
Q: When does AI in the SOC become a governance risk rather than an efficiency gain?
A: It becomes a governance risk when it changes decision timing, action sequencing, or approval boundaries without clear policy.
Q: Why do AI-assisted SOC workflows often increase complexity?
A: They increase complexity when organisations add separate tools for triage, investigation, and response without a single operating model.
Q: What are the signs that an AI-assisted triage workflow is failing to reduce analyst workload?
A: The clearest signs are persistent manual research on familiar alerts, inconsistent dispositions for repeat patterns, and little movement in queue volume or decision time.
Practitioner guidance
- Define AI decision boundaries in the SOC Map which steps AI may only recommend, which it may prepare, and which it may execute.
- Separate triage from response authority Do not let the same AI workflow both prioritise alerts and trigger containment unless execution permissions are explicitly constrained.
- Require reasoning logs for every automated decision Capture the data inputs, correlation steps, thresholds, and response outcomes for any AI-supported SOC action.
Bottom line: AI is widespread in the SOC, but broad adoption has not solved the control problem created by faster and more autonomous workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:00 pm
AI in the SOC is now a governance problem, not an adoption problem. When 94% of teams are already using AI while 80% still say it adds complexity, the issue is no longer whether AI belongs in security operations. The issue is whether the organisation can define decision boundaries that survive real-time incident pressure. The practitioner conclusion is straightforward: AI SOC programmes need explicit control ownership before they need more features.
A question worth separating out:
A: Start by separating investigation from response authority. Let agents enrich alerts, gather evidence, and recommend actions, but require human approval for containment, account disablement, or other high-impact steps. This preserves accountability while still removing manual enrichment work. Test those boundaries against your incident severity model and revisit them as confidence in the system improves.
👉 Read our full editorial: AI in the SOC is adding complexity faster than it reduces it