Bringing AI into the SOC means watching for shadow AI and loose permissions

In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools.

He explains how LLMs help with vulnerability analysis and detection engineering, including writing SIEM rules and small programs that analyze packets or Zeek metadata. Those using agentic triage report faster work and fewer false positives, and junior analysts can dig deeper into network data. Stoffer says a human in the loop is still needed before agents take blocking or response actions.

For attackers, AI supports coordinated agentic operations, zero-day creation, and convincing social engineering. He also covers the wave of vulnerabilities that AI models are finding.

Stoffer closes with advice on shadow AI, least privilege, auditing changes, and using network monitoring to track AI use across the organization.

Download: The IT and security field guide to AI adoption