Security leaders are embracing AI in the SOC, but trust is still lacking

AI is fast becoming a mainstay in security operations centres (SOCs), but a senior figure at Dropzone AI has warned many teams still face a delicate balancing act with the technology.

A survey from the company found AI has very much hit the “mainstream” in SOCs, with 39% of respondents using the technology in full production across tasks such as incident response and threat hunting.

More than one-third (39%), meanwhile, are using the technology for autonomous investigations, helping to support staff on the frontline in the fight against cyber crime.

Speaking to ITPro, Brett Candon, international VP at Dropzone AI, said the study highlights the growing benefits of AI in this domain. The technology is living up to the promises made by providers, reducing manual toil and enabling teams to contend with accelerating threats.

Crucially, AI is helping teams bridge long-standing gaps in response capabilities. The Dropzone study found more than half (55%) of security alerts are never investigated or validated. Notably, just 2% of organizations said they fully investigate every alert.

This is partly down to the sheer volume of alerts teams face on a daily basis, according to Candon, but also due to the fact teams have traditionally dealt with these in a manual capacity. Put simply, working at human speed leaves glaring gaps, and AI is now acting as a force multiplier.

“What we've been trying to fix for the last 10 plus years is this: too many alerts, not enough humans, fatigue in the SOC, the manual element that leaves organizations exposed, and the reality is we've been doing or trying to do this with other tools that haven't quite been successful,” he told ITPro.

“We’ve now evolved to a stage where we can actually start filling that gap with AI.”

AI isn’t a silver bullet

Candon emphasized that AI isn’t a silver bullet for streamlining security operations, but that’s largely down to how it’s being deployed – and the type of AI being used by teams.

Maturity on this front is building, but many SOCs are still using what one would describe as traditional chatbot-style AI tools. The figures on this front show that while the technology is helping, it’s not quite delivering the type of results SOC teams need.

In the UK, for example, firms reported the highest adoption rates of AI within the SOC, yet these firms had the lowest coverage of investigations, meaning they’re still struggling to react to alerts despite using AI en-masse.

“This kind of boils down to how AI is being used. So simply deploying AI is not enough. It needs to actually take workload off you, and by and large, the AI that is being used in the SOC at the moment across the UK and Europe is very much AI systems,” he explained.

“So it is driven by humans. Therefore, it is restricted by human capacity.”

Candon said these tools can be “limited by design” and only work when humans are using them during working hours, with cyber pros asking various questions and directing them to perform specific tasks.

The real advantage comes with the “next wave” of AI, namely agentic systems capable of performing tasks autonomously on behalf of human workers. Convincing SOC leaders to take the plunge into agentic AI is another challenge in itself, however.

Building trust

Conversations around AI agents often leave security leaders skittish, Candon told ITPro, especially given recent high-profile incidents involving these autonomous bots.

“We use this word autonomous, and when people hear the word autonomous, it makes them very scared or skeptical or untrusting in a lot of cases,” he said. Figures from the Dropzone survey show SOC leaders don’t fully trust agents and are wary of using them.

One-quarter (25%) of respondents cited data security and privacy concerns, for example, while the same number voiced worries that incorrect AI-driven investigations or actions would impact security outcomes.

Despite this, respondents are eager to embrace agentic AI. Being able to offload tasks to agents would be a game changer in terms of efficiency and reducing manual toil, the survey found.

Nearly one-quarter (23%) said they’re keen to integrate AI systems capable of investigating “end-to-end on its own” while another 22% would like to see AI systems capable of doing these tasks with human approval.

Safe adoption

According to Candon, this means SOC leaders need to take a considered, pragmatic approach to adoption – and that will require robust guardrails, strict controls, and close human involvement.

“It’s really about moving into this next wave of AI in a controlled manner,” he told ITPro. “So you know, don't give everything to AI to fix on day one.”

Having the ability to control what tasks AI can perform is critical, Candon added, and establishing rules on what it can touch and what it can access is vital – especially if these systems are operating out of hours and picking up slack for staff in the background.

“We fill that gap, that capacity gap, but we do it in a read-only, investigate-only mode,” he explained. “Once the agent goes in, it has zero privileges to overwrite anything [and] to perform any actions within the environment,” Candon noted.

“All it’s doing is simply collecting evidence and it’s doing that at machine-speed [and] can be doing multiple of those investigations at the same time.”

Candon told ITPro the idea here is that teams can still reduce risk exposure and tackle long-running problems such as alert fatigue, but still maintain robust human oversight.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.