Notifications
Clear all
Topic starter
02/08/2026 11:31 am
TL;DR: AI can reshape SOC economics by moving first-pass triage and investigation off human analysts and onto AI SOC agents, reducing the load created by rising alert volume and limited analyst time, according to Prophet. The operational question is no longer whether to add more people, but how to redesign capacity so humans focus on judgment-heavy decisions.
NHIMG editorial — based on content published by Prophet: Rethinking SOC Capacity, How AI Changes the Human Cost Curve
Questions worth separating out
Q: How can teams tell whether AI triage is actually improving SOC operations?
A: Look for lower manual processing time, fewer duplicate reviews, shorter disposition cycles, and faster removal of related malicious messages.
Q: Why do identity-rich alerts create bottlenecks in a human-only SOC?
A: Identity-rich alerts often require context from authentication, privilege, recent access changes, and business ownership before they can be judged.
Q: What breaks when SOC teams rely on automation without escalation discipline?
A: Automation breaks when teams assume every alert can be handled by machine logic alone.
Practitioner guidance
- Model analyst capacity against escalated cases, not raw alerts Calculate how many hours your team spends on true investigations after triage, handoffs, and validation are removed.
- Define escalation criteria before introducing AI triage Set explicit thresholds for when an alert moves from machine review to human review, including confidence, uncertainty, and identity context requirements.
- Enrich alerts with identity context at ingestion Attach authentication source, privilege scope, recent entitlement changes, and asset ownership to every alert that touches cloud, SaaS, or identity activity.
What's in the full article
Prophet's full analysis covers the operational detail this post intentionally leaves for the source:
- The step-by-step capacity model used to compare human-only, MDR-backed, and Human plus AI SOC operating structures.
- The specific alert-volume assumptions and utilisation thresholds behind the author's queueing calculations.
- The article's breakdown of how AI SOC agents change analyst responsibilities from triage to escalation review.
- The implementation-oriented discussion of where AI fits in SOC workflows, including enrichment and decision support.
👉 Read Prophet’s analysis of how AI changes SOC capacity planning →
AI SOC capacity: what changes when analysts stop doing first-pass triage?
Explore further
02/08/2026 12:46 pm
AI SOC capacity is really an identity governance problem in disguise. The article frames the issue as analyst time, but the real constraint is how well the SOC can interpret identity-rich events at speed. When alerts involve cloud credentials, OAuth grants, or service accounts, the quality of investigation depends on access context, not just detection volume. The practical conclusion is that SOC design and IAM design now need to be planned together.
A question worth separating out:
Q: How do you know if an AI-driven SOC platform is actually improving operations?
A: Look for lower false-positive effort, better escalation decisions, and faster resolution with less analyst burnout, not just more automated closures. A credible platform should explain its verdicts using environment-specific context and preserve human control over high-impact actions. If analysts still have to rebuild context manually, the platform is only accelerating the same old work.
👉 Read our full editorial: AI changes the SOC capacity model, but not the need for judgment
