Topic starter
02/08/2026 11:39 am
TL;DR: 94% of organisations already use AI in some SOC capacity, yet only 37% deploy it for triage and 92% of security leaders say trust is being reduced by current AI use in the SOC, according to torq’s AI SOC Leadership Report. The gap points to visibility, control, and explainability as the real blockers to scale, not model capability.
Editorial analysis by NHI Mgmt Group, based on content published by torq: “AI Security and Trust: Why SOC Teams Don’t Trust AI”.
By the numbers:
- 94% of organisations use AI in some SOC capacity, according to torq.
- Only 37% of organisations deploy AI for triage, even though it is one of the most obvious SOC use cases, according to torq.
- 92% of security leaders say something is actively reducing their trust in AI within the SOC, according to torq.
Key questions
Q: What breaks when AI triage tools cannot expose their reasoning chain?
A: Analysts lose the ability to validate the verdict, which means a wrong closure can look legitimate until after an incident.
Q: Why do security leaders trust AI in principle but still hesitate to deploy it broadly?
A: Because broad confidence does not remove concerns about data access, false negatives, control, and black-box behaviour.
Q: How should security teams implement human-in-the-loop controls for AI agents?
A: Start by classifying which agent actions require pre-execution approval, then bind those checkpoints to identity policy so only authorised humans can approve them.
Practitioner guidance
- Define AI decision boundaries in SOC workflows Set explicit limits on which alerts, data sources, and response actions AI may access, and which decisions require human confirmation.
- Require reviewable reasoning for every AI action Make reasoning paths, evidence references, and action histories available to analysts so they can validate outputs without recreating the work manually.
- Separate triage automation from response authority Allow AI to classify and prioritise alerts before granting it any ability to trigger containment, ticket changes, or remediation steps.
Bottom line: AI in the SOC is no longer a novelty problem; it is a trust and governance problem because adoption is outpacing deployment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:51 pm
Trust failure in the SOC is a governance problem before it is a model problem: the article shows that security leaders are not rejecting AI capability, they are rejecting opaque operational control. When teams cannot see what data was used, what logic drove the outcome, or where human override begins, they cannot scale automation safely. That makes visibility and accountability the real deployment gate.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: How do teams know whether AI is actually fit for SOC response?
A: Look for evidence that the system can explain its reasoning, preserve an auditable action trail, and operate within scoped permissions. If analysts still have to recheck every conclusion manually, the platform has not reduced operational burden, only redistributed it. Fit is shown by safe autonomy with measurable oversight.
👉 Read our full editorial: AI SOC trust gaps persist because deployment lags confidence