Notifications
Clear all
Topic starter
02/08/2026 11:51 am
TL;DR: AI is pushing security operations toward new team designs, with human authority, accountability, and the CISO’s remit all under pressure as AI enters the SOC, according to Torq. The practical shift is less about automating more tasks and more about deciding where judgment, escalation, and control must remain human.
NHIMG editorial — based on content published by torq: CISO to CISO: Redesigning SecOps for AI
By the numbers:
- What 450 CISOs and security leaders reveal about what AI is actually doing inside their SOC and what needs to change.
Questions worth separating out
Q: How should security teams govern AI-assisted actions in the SOC?
A: Security teams should treat AI-assisted SOC actions as policy-governed machine behavior, not informal automation.
Q: Why do agentic AI SOC analysts create new identity risk for security operations?
A: Because they consume sensitive telemetry and may act on it, they concentrate access into a system that can observe, decide, and sometimes respond.
Q: What breaks when human authority is not defined in AI-driven security operations?
A: Escalation, containment, and closure can become fast but unaccountable.
Practitioner guidance
- Map SOC decision rights explicitly Document which AI-driven actions are advisory, which are auto-executed, and which require human approval before containment or closure.
- Inventory SOC machine identities and service accounts Identify every token, API key, and service account used by AI-enabled SOC workflows, then scope each credential to the smallest practical set of tools and actions.
- Separate workflow execution from authority to approve Design approval paths so the system can gather data and propose actions without holding unrestricted permission to contain, close, or change cases.
What's in the full article
Torq's full blog series covers the operational detail this post intentionally leaves for the source:
- The leadership framing from Torq Field CISO John White on how AI changes SOC team design and accountability.
- The article's full discussion of where human authority should sit when AI supports triage, routing, and response.
- The broader CISO role changes the series explores across security operations, leadership, and governance.
- The sequence of practical tensions the source uses to connect automation, trust, and control in the SOC.
👉 Read torq's CISO-to-CISO series on redesigning SecOps for AI →
AI SOC operations in 2026: where does human authority sit now?
Explore further
02/08/2026 1:00 pm
AI SOC programmes are becoming identity programmes in disguise. Once AI tools are allowed to triage, enrich, or trigger response actions, the real control question becomes who or what is authorised to act. That makes the machine identity of the SOC itself part of security governance, not just an implementation detail. Teams that ignore workflow identities will eventually discover that automation has outgrown their approval model. The practitioner conclusion is simple: AI SOC design must be governed like privileged access.
A question worth separating out:
Q: How can organisations tell whether AI automation is staying within its intended boundary?
A: Look for clear ownership, separate permissions for separate tasks, and logs that show what the system accessed and changed. If the same agent can triage, educate, and report without distinct scopes, the boundary is already too loose. A safe design makes every automated action traceable to a specific approval and a specific purpose.
👉 Read our full editorial: AI SOC redesign forces clearer human accountability in security operations
