What if your SOC analysts were your best asset against attackers’ AI? Provided you arm them correctly?
I myself have been at the heart of SOC teams during ongoing attacks. I know what it feels like to see alerts piling up, when you have to inform the CISO while trying to keep your thoughts clear. This pressure has not changed.
What has changed are the numbers. Five years ago, most organizations still had room to maneuver. Sophisticated attacks were expensive. Targeted campaigns required real investments. This room for maneuver has disappeared.
Attackers have always had the structural advantage in cybersecurity, but AI has amplified it. Defenders can only regain ground by deploying context-based AI systems and automation.
The numbers are now in favor of the attackers
AI is dramatically accelerating software development, and attackers are using it to discover and exploit vulnerabilities with unprecedented speed. This means attackers move from vulnerability to exploitation more quickly, as the figures show.
Intrusion times are collapsing. Attackers often move laterally in less than an hour, or even minutes. Execution has taken precedence over concealment: attackers prioritize speed and payload delivery over stealth. Exploitation of vulnerabilities is now almost instantaneous. Malicious actors almost immediately begin scanning and probing newly disclosed vulnerabilities.
If they can achieve their goal before we complete our triage, they don’t need to hide for weeks. We are now faced with human ingenuity powered by machine speed, and manual procedures cannot win this fight.
AI is not a strategy, it’s architecture
Security leaders are integrating AI capabilities into existing architectures, but that’s not enough. Surviving the AI era requires rethinking how analysts, data, and automation interact.
Five principles must guide this evolution:
1. Don’t replace analysts, build their capabilities
The idea that AI should replace SOC analysts is short-sighted. Even if some tools can reproduce basic results, replacing them with apprentices eliminates the pool that will produce future experts.
The true value of AI lies in its ability to reason at machine speed, from deep context, providing actionable insights to defenders in real time. While security teams have long operated under pressure, AI is boosting their efficiency. Not by replacing human judgment or instantly outpacing adversaries, but by amplifying human expertise. When AI and humans work in tandem, the AI can highlight patterns and provide recommendations, while humans validate them, creating a collaborative approach by keeping the human in the loop. We need technology that creates a shared intelligence layer, providing both AI models and human experts with the deep, actionable context needed to solve complex problems.
2. Transform noise into sovereign intelligence
We have all felt the weight of the volume of logs. Data gravity is real. And with increasing requirements for sovereignty and residency, sending everything to a centralized “brain” isn’t always practical.
The smarter approach is to move intelligence to data. The days of centralizing all data are over. Today, AI should be able to ingest, correlate and prioritize threats where the data is.
3. Close the vulnerabilities window
An attacker can act in 11 minutes while your response takes thirty. After tracking adversary behavior for years, we found that the execution phase of the MITER ATT&CK framework emerged as the predominant signal. Attacks are faster, and adversaries are increasingly willing to use sophisticated techniques to gain velocity and impact. Attackers have automated their attack chains, while defenders remain stuck sorting through alerts manually.
Adopt a clear standard: prevent what can be prevented, automate the rest. The AI must first act as a shield, blocking attacks before code execution. For threats that materialize, defenses need a nervous system that reacts instinctively, correcting the problem using the same means of automation that the adversary uses to attack.
4. Bridging the gap between tools and know-how
Many organizations have powerful platforms, but only a handful of engineers are able to fully exploit them. Complex syntax, obscure query languages, and fragmented telemetry create artificial barriers.
AI is the equalizer here. It democratizes cybersecurity, making advanced investigation and analysis capabilities accessible to many more people than ever before. When a junior analyst can formulate his hypothesis in clear language and obtain contextualized and precise results, the collective defensive capacity of an organization increases, because it is no longer limited to a handful of highly specialized experts.
5. The community effect
The last crucial change is philosophical. Privacy does not scale with the speed of machines. The community, yes. The diversity of perspectives creates a global early warning system. A detection written by a researcher in Brazil can save a bank in London five minutes later.
But community alone is not enough. We must combine this collective intelligence with the accessibility of AI. Community provides breadth, AI provides depth. Together, they allow us to fight back on a large scale.
Implement change
And now ? This philosophy is useless without process. To truly realize this advantage, security leaders must focus on these immediate changes:
- Spot repetitive tasks: Identify cases where analysts are acting like robots, manually correlating logs, writing basic queries, or summarizing tickets. This is where AI has its place.
- Open communication channels: Evaluate how you interact with the broader dedicated community. If you’re not actively participating in ISACs, professional meetings, and peer-to-peer information sharing, you’re creating your own blind spots. There is an advantage to working beyond your team.
- Formalize AI-assisted workflows: Update operational guides to define when and how analysts should leverage AI in an investigation. But remember, AI is a force multiplier, not a silver bullet for broken processes. Integrate this “superpower” into a well-designed workflow, ensuring solid processes guide its use rather than relying solely on AI.
- Choose partners, not just suppliers: Your technology stack is your line of defense; don’t fill it with black boxes. Look for partners who develop openly and view AI as a native foundation rather than a paid add-on. In such a fast-paced fight, you can’t afford to be cut off from the rest of the world.
The tools to win this fight exist. The community is ready. The only variable left is whether we have the discipline to update our processes to adapt to the speed of the threat.
