Notifications
Clear all
Topic starter
27/06/2026 2:03 pm
TL;DR: AI use is already routine in security operations, with 75% of analysts using it weekly and 73% of organisations enforcing controls such as approvals, audits, and policy frameworks, according to Abnormal AI's survey. Trust, transparency, and human oversight now determine whether AI improves SOC performance or creates new governance risk.
NHIMG editorial — based on content published by Abnormal AI: AI trust and governance in the modern SOC
By the numbers:
- 75% of analysts are already using AI at least weekly to support their work.
- 73% have implemented either full or broad control over AI usage, including strict approvals, audits, and policy frameworks.
- Over 60% of security leaders cited transparency around model development as critical when evaluating solutions.
Questions worth separating out
Q: How should security teams govern AI use in the SOC?
A: Security teams should govern AI in the SOC as delegated operational authority, not as a black-box productivity tool.
Q: Why do SOC teams need transparency before adopting AI tools?
A: Transparency is necessary because SOC decisions require auditability, explainability, and confidence in failure modes.
Q: What breaks when AI outputs are treated as final decisions in security operations?
A: Accountability breaks first, followed by auditability and contextual judgement.
Practitioner guidance
- Define AI decision boundaries in the SOC List which tasks AI may assist, which require human approval, and which remain fully human-owned before any automation is expanded.
- Document model transparency requirements Require visibility into training data sources, confidence thresholds, and known failure modes before accepting AI outputs into triage workflows.
- Map accountable roles for AI-assisted response Assign a named human owner for each AI-influenced decision path so that audit trails show who approved the final action.
What's in the full report
Abnormal AI's full report covers the operational detail this post intentionally leaves for the source:
- Survey breakdowns of how analysts use AI in daily SOC work and which tasks they trust it with most.
- The control patterns organisations are applying, including approvals, audits, and policy frameworks.
- Leadership and analyst sentiment on transparency, human oversight, and role changes in SOC operations.
- The practical implications for team design as new roles emerge to manage AI within the SOC.
👉 Read Abnormal AI's full report on AI trust and governance in the modern SOC →
AI in the SOC: what security teams need to govern now?
Explore further
27/06/2026 3:39 pm
AI in the SOC is still an identity governance problem, not just an analytics problem. Once a system can influence triage, prioritisation, or response, the question becomes who is authorised to decide, review, and override. That makes the control model similar to NHI governance even when the actor is not fully autonomous. The implication is that SOC AI must be governed as delegated operational authority, not treated as a neutral productivity layer.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant behaviour gap in adjacent identity-controlled workflows.
A question worth separating out:
Q: Who should own AI-assisted SOC decisions?
A: A named human role should own AI-assisted SOC decisions whenever the outcome can affect containment, customer impact, or regulated data handling. The AI may assist the workflow, but only accountable people can be trained, reviewed, and certified for the decision itself.
👉 Read our full editorial: AI in the SOC needs governance, not blind trust
