Topic starter
02/08/2026 11:55 am
TL;DR: SOAR deployments typically cover only 30% to 40% of alerts, while 40% of alerts are never investigated and implementations can take 12 to 18 months to show meaningful ROI, according to Torq. Static playbooks and custom scripting are now the limiting factor, not the lack of automation ambition.
Editorial analysis by NHI Mgmt Group, based on content published by torq: “SOAR vs. AI SOC: The Category That Left SOAR Behind”.
By the numbers:
- Most SOAR deployments cover 30% to 40% of alerts, according to torq.
- Legacy SOAR implementations can take 12 to 18 months to show meaningful ROI, according to torq.
- Torq says Valvoline was live in 48 hours after its AI SOC deployment.
Key questions
Q: What breaks when a SOAR platform depends on scripted playbooks?
A: The first thing that breaks is maintainability.
Q: Why do static playbooks and custom scripting slow SOC response?
A: They slow response because every change in the environment can require rework, retesting, and owner knowledge that lives in a few people’s heads.
Q: What are the signs that SOAR automation is failing operationally?
A: The clearest signs are heavy manual upkeep, repeated handoffs between tools, shallow enrichment, and playbooks that need constant edits whenever attacker behaviour changes.
Practitioner guidance
- Measure true alert coverage Quantify how many alerts are actually investigated, closed, and remediated end to end, not just routed through orchestration.
- Inventory brittle automations Identify playbooks that depend on custom scripting, fragile API dependencies, or a small number of engineers.
- Add governance gates for high-impact actions Require explicit approval paths, immutable logs, and scope boundaries before any automated response can isolate accounts, quarantine assets, or alter access states.
Bottom line: SOAR’s core weakness is not lack of automation ambition, but dependence on static playbooks that cannot keep pace with changing tools and threats.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Static playbooks have become a governance problem, not just an efficiency problem. The article shows that coverage ceilings, maintenance burden, and broken workflows are now the limiting factors in legacy SOC automation. Once a team depends on scripts that only a few engineers understand, resilience becomes person-dependent and fragile. Practitioners should treat this as an operating-risk issue, not a tooling preference.
A question worth separating out:
Q: How should security teams govern AI-assisted actions in the SOC?
A: Security teams should treat AI-assisted SOC actions as policy-governed machine behavior, not informal automation. Define which tools the system may access, which actions require approval, and what must be logged for later review. The goal is to keep investigation speed while preserving human accountability and least privilege across prompts, queries, and remediation steps.
👉 Read our full editorial: AI SOC exposes why static SOAR playbooks no longer scale