Notifications
Clear all
Topic starter
18/08/2026 2:41 pm
TL;DR: MDR providers and AI SOC startups are converging on the same customer problem: organisations want AI to speed up security operations, but they still want humans making decisions, according to Expel. The result is likely market consolidation, because trust, not tooling labels, will determine which models survive.
NHIMG editorial — based on content published by Expel: MDR and AI SOC are converging on the same buyer problem
Questions worth separating out
Q: How should security teams govern AI-assisted actions in the SOC?
A: Security teams should treat AI-assisted SOC actions as policy-governed machine behavior, not informal automation.
Q: Why do MDR and AI SOC categories keep converging?
A: They converge because customers want the same outcome: faster triage, better prioritisation, and fewer missed incidents.
Q: What breaks when SOC teams automate without identity visibility?
A: When SOC teams automate without identity visibility, they lose context about which identities moved, what privileges changed, and whether an access path was legitimate.
Practitioner guidance
- Define decision boundaries for AI-assisted SOC workflows Classify which actions remain advisory, which require analyst approval, and which can execute automatically.
- Separate identities for analysts and automation Use distinct accounts, privileges, and logging for human analysts, SOAR playbooks, and AI-driven tooling.
- Measure SOC value by containment quality Track the speed, accuracy, and reversibility of AI-assisted decisions rather than the number of alerts processed.
What's in the full article
Expel's full article covers the market discussion and analyst context this post intentionally leaves for the source:
- The full conversation on how MDR providers are adding AI capabilities while AI SOC vendors hire human analysts to backstop automation.
- Direct quotes from Expel leaders on the customer trust problem that shapes security operations buying decisions.
- The analyst framing behind the Gartner MDR timing and the broader market consolidation thesis.
- The practical discussion of how security teams are balancing platform consolidation against specialist coverage needs.
👉 Read Expel's analysis of the MDR and AI SOC market convergence →
MDR vs AI SOC: what the convergence means for security teams?
Explore further
18/08/2026 3:25 pm
MDR and AI SOC are converging because customers buy outcomes, not category labels. Security leaders do not care whether triage is branded as MDR or AI SOC if it reduces dwell time and improves containment decisions. The market will consolidate around operating models that combine machine speed with human accountability. Practitioners should evaluate providers on decision quality, escalation logic, and response governance, not on how neatly they fit a marketing category.
A question worth separating out:
Q: Should teams keep best-of-breed tools or consolidate around a platform?
A: Most teams will need a hybrid answer. Consolidation reduces operational overhead, but specialist tools still matter when platforms lag new threat patterns or complex identity-driven workflows. The right test is whether the stack can maintain coverage, accountability, and response speed without creating blind spots.
👉 Read our full editorial: MDR and AI SOC are converging on the same buyer problem
