Triage is the work that defined tier 1 of the security operations centre (SOC): deciding whether an alert is real, how bad it is and who needs to know. This chapter takes as its premise, argued in Chapter 3, that AI can now take part in that work: it enriches, correlates, summarises and, where an organisation or a supplier allows it, closes alerts without a person reading them. It describes triage as transformed and asks the question that follows honestly: what is lost and what is gained when a machine closes the alert, who answers for an intrusion that was closed by mistake, and how the quality of triage is shown when most alerts are never read by a person. It concerns B2 Detect, because the alerts that reach triage are the product of detection and their closure is the measure of its cost, and B3 Investigate, because triage is the first step of investigation and the point where an alert becomes a verified case or is set aside. The chapter takes the capability map of AI Red Team, Chapter 18, as given (64, Nordqvist, 2026) and asks what it does to the work, the record and the people.
An alert is a claim about the world: this pattern of events indicates activity that deserves attention. Like any claim it needs evidence, context and a decision, and it can be wrong in two ways. It can be false, because the detection logic fired on something that is not what it describes, or it can be accurate and benign, because the event is real but reflects legitimate behaviour in the organisation. The distinction matters for what AI can be asked to do. In a qualitative study of SOC practitioners, Alahmadi, Axon and Martinovic surveyed 20 practitioners and studied 21 more; they report that most of the alarms practitioners called false positives were in fact benign triggers, technically accurate alarms that reflect legitimate behaviour, and that validating alarms is tedious and can lead to alarm burnout and desensitisation (69, Alahmadi et al., 2022). The study describes what practitioners said, not how many intrusions were missed. It does show where the volume comes from and why closing it is a different problem from finding intrusions: much of the queue is made of true statements about harmless events.
Triage therefore consists of three decisions that are worth keeping apart, because they can be delegated differently. The first is validity: is the claim true, and what does the evidence say? The second is consequence: if it is true, how bad is it, which assets and which people are concerned, and is the activity still going on? The third is routing: who must act, and by when? In the traditional model tier 1 made all three for every alert. Tier 1 was also the entry rung of the profession: analysts learned what normal looks like by closing thousands of alerts that were normal. That second function was never written into a job description, and AI removes it without anyone having decided to. Chapter 23 returns to it.
Primary topics explored
- The alert as a claim
- What AI does in triage
- The closure policy
- Measuring triage quality
- The verified case
- Managed triage
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 7: Triage Transformed: From Alert Queue to Verified Case in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Craft” and is one of 32 drawn from the manuscript.