I underestimated how fast security teams would trust AI to act in the SOC
For most of my career, I have watched new security platforms work through enterprise programs at a slow pace, so when AI began showing up in security operations tools, I assumed it would follow the same path. I expected AI adoption in the SOC to lag behind almost every other category of security technology, because I’d always viewed the tension between moving quickly on innovations and satisfying strict compliance obligations as a blocker.
Ultimately, AI moved into the SOC much faster than I expected, and the reason has far more to do with how AI has reduced the time between threat detection and impact. Over the past year, the organizations I have spoken with have taken an honest look at their alert queues, their staffing models, and the hours their analysts lose to repetitive investigation work. They concluded that waiting meant alerts would go uninvestigated and backlogs would grow, all while attackers use AI to move faster.
The assumption that AI cannot act
One of the most widely held beliefs in security right now is that AI is useful for summarizing alerts and assisting with triage but cannot be trusted to take response actions inside a SOC. That belief made sense when early tools produced confident answers without showing the evidence behind them. Today, I’m speaking with a growing number of organizations that are allowing AI to take on more responsibility across the SOC lifecycle. The clearest difference between those teams and the skeptics lies in the strength of the data beneath their AI.
The teams that have made this work don’t hand over full autonomy on day one. Most begin with AI operating as an assistant that investigates an alert, assembles the supporting evidence, and recommends an action for an analyst to review and approve. Every step is recorded, so the reasoning can be audited after the fact. As the system builds a track record of accurate conclusions on the categories of alerts that consume the most analyst time, those teams gradually allow it to act on its own within boundaries they define.
Invisible Technologies shows how that trust develops in practice. Its lean security team covers fraud detection, corporate security and production monitoring, and as the company added tools, investigating activity became harder to sustain. Invisible brought in Exaforce for 24/7 coverage, and the platform now triages the team’s alerts by connecting activity across those systems and presenting the evidence behind each conclusion, so analysts can check the reasoning instead of reconstructing it themselves.
In one case, Exaforce traced suspicious activity on one of Invisible’s AWS machine accounts to a residential IP address belonging to a shared employee workspace, a benign explanation the team could confirm quickly rather than spend hours chasing. Since adopting Exaforce, Invisible has cut mean time to investigate by 95 percent and reclaimed more than six full-time employees’ worth of time each month. Its experience reflects the idea that trust comes from a track record of accurate, explainable findings the team can validate, which allows a small team to take on far more without adding headcount.
Why trust follows the data foundation
The second assumption I would challenge is that purpose-built AI models for security are all built in roughly the same way, because the foundations beneath them vary enormously, even among tools that claim to solve exactly the same problem. Some products place a large language model on top of a traditional data layer that was designed for search and storage rather than reasoning, forcing the model to reconstruct the relationships between identities, cloud resources, configurations and activity every time it investigates an alert. That reconstruction is precisely where errors and inconsistent answers tend to creep in.
The approaches that earn the trust of security teams are built on a data foundation designed to complement AI, with a semantic knowledge graph that already understands how entities in the environment relate to one another, along with the business context that allows a model to reason over facts instead of guessing. A knowledge graph is one way to provide that context, but the broader requirement is consistent: AI needs access to reliable, connected and sufficiently current data to support its conclusions. A sophisticated data architecture is not, on its own, a guarantee of accurate decisions.
For CISOs evaluating AI for their SOC, the most revealing questions are whether the system can show the evidence behind every conclusion it reaches, whether it correlates identity, cloud, SaaS and endpoint data continuously, and how the quality of its answers holds up when one of its data sources goes missing. They should also ask what the system does when evidence conflicts, how it communicates uncertainty, and whether missing data causes it to pause an action or proceed anyway.
What CISOs should do over the next 12 to 18 months
The urgency comes from attackers, who face none of the compliance constraints and are already using AI to shorten the time between finding a weakness and exploiting it. In a recent attack on government agencies in the Asia-Pacific region, researchers found a single operator running several AI agents at once. Dozens of technology and security companies have since warned in an open letter that defenders may have only months to strengthen their foundations.
Over the next 12 to 18 months, I expect that ignoring the role of agents in security foundations will be a harder bet, because the work sitting in alert queues and ticket backlogs will need to be done at a speed and scale that matches the pace of attackers. I would encourage security leaders to prioritize the following:
1. Treat known vulnerabilities as live exposure. Treat the backlog of known software vulnerabilities and misconfigured settings as active exposure rather than deferred maintenance, since the window an attacker needs to find and exploit them is shrinking with every generation of AI models.
2. Measure real response times. Track how long the team actually takes to respond to a confirmed threat in real time, including on nights and weekends, and identify which steps in that process could be safely handed to AI under human oversight.
3. Schedule threat hunting. Make proactive threat hunting a scheduled practice rather than something that happens only when the queue happens to be quiet, which becomes realistic once routine triage and investigation are no longer consuming the bulk of analyst hours.
4. Close the data gaps. Audit the data that feeds the SOC and close the gaps in identity, cloud and SaaS visibility that would leave any AI system, or any human analyst for that matter, reasoning with incomplete context.
Being wrong was the good news
Being wrong about the pace of AI adoption in security operations has turned out to be one of the more encouraging surprises of my career, because it reflects security teams’ commitment to recognizing their own gaps. The organizations that will benefit most from this shift are the ones that build trust deliberately, by grounding AI in a strong data foundation, keeping people in charge of the decisions that carry the greatest consequences, and expanding autonomy only as the evidence supports it.
For CISOs, AI is accelerating change faster than any technology before it. The organizations that stay ahead will be those that embrace AI SOC while asking the right questions, scrutinizing the data foundations behind each platform, and separating real operational impact from AI hype. Getting this right requires a deliberate approach: starting with strong data foundations, asking the right questions for context, and measuring AI by the outcomes it delivers.
That is the approach we have built around Exaforce, and it is the approach I would recommend to any CISO who is still deciding how far and how fast to let AI act inside their SOC.
