The AI-Assisted Security Operations Centre

The security operations centre (SOC) is where an organisation finds out that something is wrong, and where most organisations first put AI to work in cyber defence, because alerts arrive faster than people can read them and the few that matter look much like the many that do not. AI that reads, summarises and correlates promises to give analysts back their time. However, it brings new risk into the one function that must not be misled, because much of what a SOC reads is written by the adversary.

This chapter follows the AI-assisted SOC from intake to closure, including investigation agents, the monitoring of AI systems, analysts' command and work with a managed security service provider (MSSP). In NIST CSF 2.0 terms the chapter is responsible for two Categories of the Detect Function: DE.CM Continuous Monitoring, in which assets are monitored to find anomalies, indicators of compromise and other potentially adverse events, and DE.AE Adverse Event Analysis, in which those events are analysed to characterise them and detect cybersecurity incidents (19, NIST, 2024). Chapter 19 treats what feeds the SOC.

Mandiant's M-Trends 2026 reports that global median dwell time rose from 11 to 14 days, that organisations detected malicious activity internally first in 52 per cent of its 2025 investigations, and that the estimated mean time to exploit a vulnerability has fallen below zero, so that exploitation routinely begins before a patch exists (45, Mandiant, 2026). It urges defenders to treat routine malware alerts as indicators of an impending secondary intrusion.

Primary topics explored

1. Why the SOC needs AI, and why it must be careful
2. The SOC workflow, step by step
3. Triage and enrichment with AI
4. Investigation agents
5. Monitoring AI systems
6. Analysts in command