AI Inside the SOC: Where Automation Earns Its Place, Measured Honestly

Most organisations do not suffer from too few alerts. They suffer from alerts nobody has time to read. The cost of a missed breach is rarely that no tool fired; it is that the alert sat in a queue behind four hundred others that looked identical. Automation is valuable precisely because triage is repetitive, and repetition is what people do worst at 3am.

Signatures are cheap, precise and blind to anything new. Behavioural models are the opposite: they catch the unfamiliar, but they need a baseline and they will flag legitimate change — a new project, a new integration, a busy quarter-end. The mature answer is both, with the behavioural side tuned continuously against how your organisation actually works.

Tuning is not a one-off project. A model trained on last year's traffic degrades as the business changes. If nobody owns tuning, detection quality falls quietly until an incident reveals it.

Automated containment is the highest-value and highest-risk part of the work. Isolating an infected laptop at midnight is obviously correct. Isolating a production database server at 11am during month-end close may cost more than the incident it prevented. We therefore tier every playbook: notify only, contain reversibly, or contain and escalate — with the tier agreed per asset class in writing, before anything is switched on.

Ask for numbers from your own environment, not from a vendor brochure. Four measures tell you almost everything, and all four should be reported monthly with the raw definitions attached.

Which exact task does the model perform? Where does our data go, and does any of it leave our environment? What happens when the model is wrong — who notices, and how fast? Which actions can the system take without a human, and who approved that list? Can we see the audit log of every automated action from last month?