Why your AI SOC is not fit for purpose

From being used to discover vulnerabilities including the recent PHP issues to automated attacks, AI is turbo-boosting the capabilities of attackers. The technology is ramping up threats while also shortening the response window, making it much harder for defenders. But what’s exacerbating the difficulty is that AI is still being treated as an add-on with no fundamental change to threat detection and response.

The incorporation of AI into the Security Operations Centre (SOC) is a perfect example. Here, the technology has been used to automate and generate triage as well as to enrich, summarise and correlate events before providing the analyst with recommended courses of action. That’s all commendable and has helped to alleviate workloads and free up analysts to focus on more human-worthy endeavours such as threat hunting. But in reality, it fails to harness the potential of the technology and is even hobbling it.

Alert-driven is antiquated

The problem with this approach is that it sees AI rely and act upon the alert. By the time that has been generated, valuable time has been lost not to mention data because the events that produced it have already happened. The detection rules used to generate it will also inevitably lead to data gaps that are then passed on to the AI model, so that the AI is being tasked to work after the fact with incomplete data.

We need to turn the concept of the alert-led SOC completely on its head if we are to counter the threat posed by AI-powered attacks and that requires a complete rethink of where AI is brought into the equation. If AI is used from the start alongside detection to examine events as they arrive, the technology is exposed to all the raw telemetry at the point of creation. Its understanding is then able to grow as the data is generated.

Behavioural analysis adds another string to the bow of AI, enabling it to recognise attacks by using operational context to distinguish between legitimate and suspicious activity and to connect behaviour patterns across the estate. The AI can then accelerate investigation and preparation while the human analyst retains control over the action to be taken.

Preventing zero-days 

Another advantage is a host of AI models can be used together. These can cross-check every investigation from different perspectives, building an auditable view of each alert. Further,  an anti-hallucination layer could then validate findings against threat intelligence and deterministic detection engines before the results were then passed to the analyst. Should the models disagree, the analyst is then able to review the information and come to their own conclusion based on their own knowledge of the estate and the risk tolerance of the organisation.

But what excites me most is that unlike in a traditional SOC environment which is largely reactive because it relies on sequential alert triage and retrospective investigation, an AI-native SOC could be predictive in nature. That’s because the AI is exposed to event data as it happens, enabling millisecond detection of known and emerging indicators of compromise. New threat intelligence can then be applied immediately as detection rules, facilitating predictive modelling that can spot where and when issues could occur. This could all but eliminate the risk from emerging threats such as zero-day attacks. 

Sovereignty and CNI 

That kind of capability puts this form of defence firmly in the sights of those organisations deemed of critical national importance, such as our utilities, data centre and telecom providers, but also those manufacturers and retailers who have time sensitive operations and are of significant importance to the UK economy. For them, resilience isn't just about identifying threats faster; it's about ensuring their ability to defend remains intact. So they’ll require complete control or sovereignty over their defence, necessitating the use of AI at the local level with minimal dependence upon frontier models.

These organisations can benefit from an AI hierarchy that sees a local model layer used to handle environment-specific detection and analysis, a security intelligence layer to aggregate and correlate threat data at scale, and a frontier model used for non-sensitive enrichment and broader analytical tasks. Such a structure ensures that sensitive data remains contained while still enabling advanced AI capability where appropriate, supporting both compliance and performance requirements.

Keeping AI local can also provide additional benefits. The technology can be used to mirror IT/OT environments, for example, with passive discovery used to create a digital twin. That twin can then be used to safely emulate attacks or to identity risks before they can be exploited and ensures immutable preservation of analytical integrity. This attack sandbox can prove invaluable in organisations where live testing is frequently deemed impractical or seen to carry an unacceptable risk. 

So, it’s not just a case that we need to rebuild the SOC to counter AI attacks. Doing so also allows us to harness the technology in ways we’ve previously only ever dreamt of. If we are brave enough to reinvent the SOC we stand to gain from not just speed of response but by being able to safely simulate how those attacks might manifest and even to predict and prevent those attacks from becoming incidents in the first place.