Topic starter
06/09/2026 3:44 pm
TL;DR: A hackathon at the AI SOC Summit showed 17 security practitioners building 11 AI SOC agentic skills for alert triage, automated hunts, data enumeration, and report generation, with an average score of 84/100 and a four-point margin between winners, according to Crogl. The pattern suggests SOC teams will need tighter governance around AI-driven workflows, not just faster automation.
Editorial analysis by NHI Mgmt Group, based on content published by Crogl: “A Deep Dive into Innovation: The AI SOC Summit Hackathon Recap”.
By the numbers:
- 17 security practitioners took part in the hackathon, according to Crogl.
- 11 distinct skills were submitted in the competition, according to Crogl.
- Participants achieved an average score of 84/100, according to Crogl.
Key questions
Q: What breaks when an AI analyst triages alerts without human review?
A: When an AI analyst triages alerts without human review, the main failure is not volume reduction, it is loss of inspectability.
Q: Why do AI-driven SOC workflows need stronger governance than traditional automation?
A: Traditional automation follows predefined rules, but AI-assisted workflows can change how a case is interpreted, prioritised, or escalated.
Q: How do security teams know whether AI access is actually working safely?
A: Look for three signals: complete discovery of the AI estate, clear mapping of source data to each system, and logs that prove what was accessed and why.
Practitioner guidance
- Define AI task boundaries for SOC workflows List which steps AI may perform in triage, hunt execution, data enumeration, and report drafting, and require analyst approval for any step that changes case status or communication.
- Lock down evidence sources before automating investigations Constrain AI agents to approved log sources, case repositories, and detection tools so enumeration does not wander into unreviewed datasets or sensitive investigative material.
- Require provenance for AI-generated SOC outputs Attach source links, timestamps, and analyst sign-off to any report or briefing that includes machine-generated conclusions, especially when used for leadership or audit.
Bottom line: AI SOC automation is moving from simple alert handling toward delegated investigation work, which changes the control problem as much as the operating model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 3:45 pm
AI SOC skills are becoming a governance category, not a tooling feature. Once an AI system can triage, hunt, and draft reports, the real question is not speed but permissioning, auditability, and accountability. SOC teams should treat these agentic workflows as governed operational capabilities with explicit boundaries, because the output can shape incident decisions and executive reporting.
A question worth separating out:
Q: Should teams compare AI triage automation with report generation first?
A: Yes, because they carry different risk profiles. Triage automation affects operational decisions in real time, while report generation affects how findings are communicated and audited. Teams should prioritise the workflow with the highest decision impact and the weakest review controls, then expand only after the evidence trail is reliable.
👉 Read our full editorial: AI SOC hackathon automation points to faster triage and reporting