Two-thirds of cyber threats still require manual resolution

Automation and agents in Security Operations Centers (SOCs) aren't easing the job of security analysts, with teams overwhelmingly stuck having to resolve problems manually.

Security analysts are forced to spend 68% of their day on reactive alert triage and manual data gathering, leaving little time for proactive threat hunting. Meanwhile, 68% of all threat detections still require manual human intervention to resolve, a new report from network intelligence form ExaHop has revealed in a new report.

"Security teams are facing a crisis in dealing with AI-powered threats," said Jamie Moles, Senior Technical Manager, ExtraHop.

"To solve this, security teams are diligently working towards achieving an agentic SOC that drastically expedites the entire security response cycle while eliminating the burden and fatigue analysts have been experiencing."

When asked which elements of the attack surface they believe represent the most significant cybersecurity risk, 55% of survey respondents cited AI agents and generative AI applications, followed by public cloud services at 45% and third-party services and integrations at 35%.

However, the researchers said the timeline to identify threats has lengthened, with 49% of organizations only identifying ransomware activity after it reached the data exfiltration or later stages – up from less than a third in 2025.

Nearly 15% failed to recognize that they were being targeted until a ransom demand was issued, up from 6% the previous year.

When asked which factors delayed a critical alert from being detected or investigated, 41% cited the use of encrypted channels to bypass detection. Meanwhile, 38% said that attacker activity mirrored legitimate, authorized workflows and processes, and 34% noted that valid, high-privilege account permissions were used in the attack.

As a result, SOC workflows remain heavily manual, with most respondents reporting mid-to-high levels of manual intervention across the threat lifecycle. Investigation was the most manual stage, requiring manual intervention about 50% of the time.

SOC analysts are limited to spending just 44% of their time on proactive efforts, such as threat hunting and detection engineering.

The problem, the firm said, extends across all SOC-adjacent job roles and organizations of all sizes. While larger companies show a slight trend toward spending more time on proactive efforts, the increase isn't proportional to the size of the company, showing that scale doesn't solve the problem.

In order to make the most of AI models and reduce the burden on human analysts, said ExaHop, organizations need a base-level layer of contextual intelligence that allows agents to act decisively and quickly.

"A well-trained AI model has the reasoning and processing capabilities to analyse environment-wide anomalies instantly, doing in seconds what would take a human analyst hours. But these powerful models must be implemented with the right safeguards in place, sitting atop a layer of intelligence that can be easily accessed and acted upon," said Moles.

"Automated security will be the standard, but without the right underlying foundation, organizations will continue struggling to keep up with high-velocity threats."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.