Topic starter
27/06/2026 1:52 pm
TL;DR: SOC leaders found that AI worked best for data collection and enrichment, while humans outperformed automated judgment; social engineering also dominated 2025 incidents, expanding the SOC’s remit across email, identity, hiring, and collaboration tools, according to Abnormal AI. The lesson is that context, not just speed, now separates effective detection from noisy automation.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Year in Review: The Most Impactful SOC Lessons From 2025”.
Key questions
Q: How should SOC teams balance automation with human decision-making?
A: SOC teams should automate the mechanical parts of detection, such as enrichment and correlation, while keeping human analysts in charge of interpretation and response decisions.
Q: Why do behavioural detections work better than copied signatures?
A: Behavioural detections work better because they are built from the organisation’s own normal patterns, not from rules attackers can easily learn in advance.
Q: What are the signs that a SOC is over-automating judgment?
A: A SOC is over-automating judgment when alerts close quickly but analysts cannot explain why they were closed, or when detection quality depends on generic rules rather than local context.
Practitioner guidance
- Automate data collection and enrichment Use automation for telemetry gathering, enrichment, and correlation so analysts spend time on interpretation rather than repetitive retrieval work.
- Preserve human judgment for decisions Require analyst review for alerts where business context, trust relationships, or identity behaviour determine whether an event is benign or malicious.
- Build organisation-specific behavioural baselines Tune detections to your own authentication, collaboration, and workflow patterns instead of importing generic signatures that attackers already expect.
Bottom line: The article argues that SOC effectiveness now depends on preserving human judgment for decisions while using automation for repetitive collection and enrichment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:22 pm
Human-led judgment is now a control layer, not a fallback. The article shows that AI is most effective when it supports collection, enrichment, and correlation, while humans remain responsible for deciding what an event means. That is not a temporary operating preference. It is a governance boundary: judgment cannot be reduced to automation without losing the context that makes detection useful.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams build analysts who can handle social engineering cases?
A: Rotate analysts through real incidents, different tools, and varied alert types so they develop judgment from experience, not just queue handling. Teams that keep people in a single narrow role tend to build speed without context, which is a poor fit for identity, email, and collaboration abuse.
👉 Read our full editorial: Why SOCs are shifting from automation to human-led judgment