Articles about ai in security operations from security operations practitioners.
Three weeks after we switched on an AI triage layer, I was at my desk at 1 am pulling its auto-closed alerts back out of the archive and re-running them myself. The queue had collapsed to a few dozen alerts. I did not yet trust a closure whose reasoning I had not seen.
Impossible travel on a finance account used to eat half an hour of my night, walking four consoles by hand to prove it was just a VPN. With an AI-assisted tool the enrichment was already assembled when the case reached me, so I started where the work needs a person. The AI compressed the mechanical parts, and I kept every judgment call.
AppSec scanners generate more findings than any development team can act on. The standard response is a better aggregation platform. The response that actually works is fixing the ownership model, context injection, and feedback loop that make most AppSec findings feel like background radiation before they reach a developer's queue.
AI SOC automation earns its keep on alert triage at volume and enrichment of known alerts, but breaks where business context or data quality matters most. Track false negative rate, not the auto-close numbers vendors put on a demo dashboard.
I ran Prophet Security, Dropzone AI, and 7AI against 30 days of real production alerts instead of a curated demo, and the three diverged far more than the marketing suggests. The widest gaps showed up on the ambiguous cases, where the tool that scored best on raw accuracy turned out to be the weakest at explaining itself.
A detection engineer's take on why the AI SOC demo always looks clean, and what to do about it. Theo Hartley breaks down the six incentives that make curated demos the rational default, why POC numbers don't survive contact with production data, and how to run an evaluation the vendor can't script against.
An AI SOC agent closed an impossible-travel alert with a full evidence chain in under four minutes. It also recommended isolating a production server over clean traffic the same week. Marta Kowalska walks one real Entra ID alert through the agent's full investigation chain — and shows exactly where the reasoning broke on a different alert class.
Every AI SOC vendor says the technology augments analysts. Their own ROI math says something different. Theo Hartley breaks down why "augmentation" is doing commercial work rather than describing the product — and what the broken entry-level hiring pipeline tells you about where Tier 1 is actually headed.
The autonomous SOC demo cleared 40 curated alerts in under two minutes. Four hours into a real production queue on a Wednesday night, it had already stalled on a custom cloud detection, silently closed a dedup cluster, and skipped an alert that needed a Jira ticket to answer.
Agentic security means two things. Practitioners need both. Here's the definitional work.
Explainability wins the demo. Auditability survives the audit. The three questions AI SOC buyers should add to their vendor scorecard.
AI triage is live in production SOCs. Learn which pipeline stages to trust it with, which to keep human-reviewed, and how to catch the new failure modes.
AI triage hasn't moved alert fatigue. The structural causes start upstream. Here's what to fix before another AI SOC pilot.
Practitioner takes on SOC modernization, detection engineering, threat hunting, and more. No fluff. No product pitches.