Defending the Defenders' AI

The security operations centre (SOC) exists to read what adversaries leave behind, and increasingly it asks AI to do the reading. That makes the defenders' AI an unusual asset: it ingests text that the adversary can write, it holds access that the adversary would like to have, and it sits on a platform whose compromise would blind the whole team. This chapter describes how to defend it. It concerns all five blue team functions: B1 Anticipate, because threat reports and feeds are attacker-writable input; B2 Detect, because detections and their pipelines can be tampered with; B3 Investigate, because investigation agents read the hostile text most directly; B4 Respond, because a manipulated agent that can act turns a reading problem into a containment problem; and B5 Learn, because the feedback that tunes the SOC's AI can be poisoned and the SOC's own AI must be red-teamed like any other system.

The chapter builds on three conclusions of the earlier volumes. AI Platform and Security, Chapter 16, concluded that prompt injection is a property of the architecture and not a patchable defect, so the controls must sit outside the model (63, Nordqvist, 2026). AI Red Team, Chapters 13 and 28, applied that to security AI: everything a security agent reads may have been written by the adversary, so the defence is a policy decision point outside the model, a permission manifest that sets a ceiling on every action, and red-team campaigns that test the ceiling (64, Nordqvist, 2026). AI Threat, Chapter 30, added the standard of proof: a control counts as a defence only when a test that re-runs its scenario has passed recently, and a containment control only when it holds without the cooperation of the system it contains (65, Nordqvist, 2026). The chapter carries these into the SOC. Chapter 14 treats the question that remains when these controls hold, how an analyst judges a conclusion drawn from evidence that may have been written to mislead.

Consider a single ordinary alert. A web server logs a request with a user-agent string chosen by the client. A mail gateway quarantines a message whose subject, body and attachment filename were written by the sender. A helpdesk ticket carries a description typed by whoever opened it, and a phishing report forwards text from outside the organisation. An endpoint tool records a process command line and a file path chosen by the program that ran. A threat report downloaded from a feed quotes strings lifted from malware. An investigation agent that enriches this alert reads all of it. Each field is attacker-influenced, and some are attacker-authored in full.

Primary topics explored

1. The SOC reads the adversary's text
2. What a manipulated agent can do
3. Controls outside the model
4. Tampering with detection
5. The SOC as tier 0
6. Supply chain of security AI