Topic starter
09/07/2026 3:25 pm
TL;DR: 60% of AI adopters have cut investigation time by at least 25%, while 87% are deploying, piloting, or evaluating AI SOC tools and only 31% use them across core workflows, according to Gurucul’s 2025 Pulse of the AI SOC report based on 739 cybersecurity leaders. The bigger issue is execution control, not adoption, because identity visibility and workflow integration are still lagging.
Editorial analysis by NHI Mgmt Group, based on content published by Gurucul: “60% of adopters of AI in the SOC have cut investigation time by at least 25%”.
By the numbers:
- The report is based on survey responses from 739 cybersecurity leaders worldwide, according to Gurucul.
- 87% of respondents are deploying, piloting or evaluating AI-powered SOC tools, according to Gurucul.
- Only 31% of respondents use AI-powered SOC tools across core detection and response workflows, according to Gurucul.
Key questions
Q: Why do AI SOC tools reduce investigation time without fixing execution control?
A: AI can cut investigation time by accelerating triage and enrichment, but execution control depends on workflow design, identity visibility, and clear handoff ownership.
Q: How should teams decide whether AI belongs in core SOC workflows?
A: Use core workflows when AI is tightly integrated into detection, investigation, and response, and when the team can trace what the system influenced.
Q: What are the signs that SOC AI is not fully operationalised?
A: Common signs include heavy manual triage, fragmented enrichment steps, limited linkage between alerts and identity behaviour, and pilot tools that never move into response ownership.
Practitioner guidance
- Instrument identity telemetry for SOC use Connect access behaviour, privileged actions, and lateral movement signals to the SOC so AI investigations are grounded in identity context rather than generic alert data.
- Define the workflow boundary for AI assistance Document which triage, enrichment, escalation, and containment steps AI may support, and which decisions must remain under analyst or incident commander control.
- Reduce manual dependency in core response paths Replace repetitive investigation steps with deterministic integrations where possible, so analysts are not forced to move between disconnected tools during active incidents.
Bottom line: AI is already reducing SOC investigation time, but speed gains do not automatically translate into better operational control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:45 pm
AI is collapsing investigation time, but not the control model behind SOC decision-making. Faster triage changes analyst throughput, not the quality of the governance boundary around detection and response. When identity signals, access behaviour, and response ownership remain fragmented, the SOC may move faster without becoming more certain. The practitioner implication is that speed gains need control-plane redesign, not just more automation.
A question worth separating out:
Q: What happens when AI speeds investigation but the SOC still lacks identity visibility?
A: The team can reach conclusions faster, but those conclusions may be based on incomplete evidence. That creates a risk of missed lateral movement, weak escalation decisions, and delayed containment, especially when identity-based attacks and phishing are already the main threat drivers.
👉 Read our full editorial: AI in the SOC is cutting investigation time but widening the execution gap