AI agents in the SOC
Mar 26th, 2025 by Jesper Kråkhede
This month Microsoft announced AI agents for Security Copilot. Agents that triage phishing reports, sort data loss alerts, prioritise vulnerabilities and suggest Conditional Access improvements, working on their own and learning from the analysts´ feedback. Other vendors are going the same way.
I have been sceptical of AI hype for a long time, so let me give you my honest view.
What works. Summarising an incident across many alerts and data sources, so an analyst understands it in a minute instead of twenty. Translating a question into a hunting query. Triaging the large volume of user reported phishing, where most reports are harmless and the work is very repetitive. Explaining a script or a command line that an attacker ran. These are tasks where AI saves real time.
What doesn´t, at least not yet. Deciding on its own to take high impact actions. Understanding the business context, like which server is critical this week. Replacing experience. An AI can tell you that a logon is unusual. It can´t always tell you that the CFO is travelling.
So how should you introduce it? Start with tasks where a mistake is cheap and the volume is high. Keep a human in the loop for decisions. Measure how often the agent is right, and give it feedback. And treat the agent like a new junior analyst: helpful, fast, but supervised.
AI won´t replace the SOC analyst. But the analyst who uses AI will replace the one who doesn´t.