AI agents are moving into the SOC for good (whether we like it or not). They can investigate at greater speed and take on repetitive tasks across large volumes of data.
The teams that benefit most will understand where AI can improve the work and where human judgment still matters. In this conversation, David Bizeul, Sekoia’s Chief Solution Officer, explains why the next SOC will combine people and AI agents. He also explores Gartner’s ISOC category and the training challenge facing the next generation of cybersecurity experts.
You can watch the full episode below, or keep reading.
A career on the blue team
Megan: What first drew you to cybersecurity?
David: I started working in cybersecurity more than 20 years ago. At the time, it was called computer security rather than cybersecurity, and I’ve seen the industry change completely.
I quickly moved to the blue side of cybersecurity. That’s where you protect organizations, understand threats, respond to cyber attacks, and work out what is happening behind them.
When you work on this side of cybersecurity, you help other people. I think that has always been a deep interest of mine. I wanted to help companies protect themselves, and I felt good about that work.
ISOC challenges the SIEM model
Megan: Gartner has introduced the Integrated Security Operations Center, or ISOC, category. What does ISOC mean for people who haven’t heard the term before?
David: Security Information and Event Management, or SIEM, is one of the oldest components in the cybersecurity industry. It has existed for almost 20 years, and most major organizations have an internal SIEM.
For a long time, the SIEM category wasn’t seriously challenged. Gartner is now bringing a new category to the market with ISOC, or Integrated Security Operations Center Solutions.
This category is designed to challenge the traditional SIEM model. The first word in ISOC is integrated, and that matters. The idea is to bring different cybersecurity capabilities together in one platform instead of making teams connect a collection of separate tools.
An ISOC solution still needs the core capabilities associated with a SIEM. It must ingest and normalize data, understand telemetry from different sources, store structured events, and apply detection rules.
It also brings other capabilities into the same platform. Cyber Threat Intelligence, or CTI, can be integrated directly into the solution. Security Orchestration, Automation and Response, or SOAR, can help determine and launch the right response when an alert is triggered.
AI agents are another part of this model. They can support different stages of the SOC workflow. They can help with triage, investigation, task definition, and detection engineering.
The goal is to have agents working together, either autonomously or alongside the existing team, to improve the work carried out by the SOC.
Human judgment moves upstream
Megan: As AI agents take on more investigations, which parts of the human role become more important?
David: People can’t compete with AI agents on speed. Agents can use large amounts of computing power and hold a huge amount of context. It’s difficult for a human analyst to match that.
Each AI agent will have strengths and weaknesses. Tomorrow’s analyst team will include people and AI agents working together.
Human analysts should focus on areas such as critical thinking and skepticism. When you need to challenge the result of an investigation, that should be done by a person.
People also need to improve the reasoning built into an agent. If an analyst sees a new approach, a new type of threat actor, or a way to discover something that may be hidden in the environment, they need to bring that idea to the agent.
That makes the human analyst a mentor to the AI agent. Each side brings capabilities the other does not have.
AI changes the shape of the SOC
Megan: Will the best security teams have fewer analysts, or will analysts work at a higher level?
David: Analysts will work at a higher level. If you apply AI agents to the right parts of the SOC workflow, you can remove painful tasks that analysts have handled for years.
Imagine a team of five people, with two or three analysts regularly working on triage. An AI agent can take over that work at scale. The analysts can then spend their time on work that brings more value to the organization.
They can tune the agent, align it with business needs, and spend more time on investigations. They’ll also be more satisfied because they can move away from repetitive work and focus on improving detection rules.
The question of headcount is more complex. The attack surface keeps growing, and threat actors are already using AI. An organization that receives 10 attacks today could receive 100 or 1,000 in the future.
If teams don’t optimize, the cybersecurity industry will struggle to keep pace. AI agents need to handle the most repetitive work so analysts can focus elsewhere.
Will SOC teams need more people or fewer people? The answer depends on how far the attack surface expands. What we know is that teams need to become more efficient.
We often say that AI will help us do more with less. I think we can do more, do better, and move faster with less.
Training the next generation
Megan: If AI takes on some of the repetitive work usually given to junior analysts, how will future experts learn the craft?
David: This is a major question for the industry. If we don’t train junior analysts, we won’t have enough cybersecurity experts in 10 years.
We still need to bring new people into the field and teach them how a SOC works, how to handle alerts, and how to respond to attacks.
A traditional path might involve a junior analyst reading documentation, completing basic tasks, and presenting the result to a senior team member for review. The senior analyst challenges the work and provides feedback.
AI can support that training. If an agent is investigating an alert, a junior analyst can review exactly what the agent did.
At Sekoia, each detection rule is associated with a runbook. The runbook explains the detection rationale, the type of attack involved, and the potential impact. It also describes the investigation questions the agent should ask and the risk of generating a false positive.
A junior analyst can read the runbook and build knowledge about the threat. They can follow the reasoning behind the investigation and learn how an experienced analyst approaches the problem.
That doesn’t mean the junior analyst disappears. The training model changes. AI agents can become part of the learning process, but senior people still need to define and tune those agents.
Challenge the agent
Megan: How can teams teach analysts to challenge an agent instead of accepting a confident answer?
David: You can’t have blind trust. People need to see how the agent reached its conclusion and review the reasoning steps it took.
The process should align with the organization’s way of working and its security procedures. If the team disagrees with the reasoning, it should be able to change the process.
A runbook describes what an agent should do when it faces a specific threat. Analysts can tune the questions and queries the agent uses. Once those checks have been reviewed and adapted to the environment, the team can have more confidence in the result.
Feedback is another part of the process. AI systems often provide a way to indicate whether the output was useful. The important part is explaining why an answer was wrong.
An analyst might explain that the agent forgot to check whether an asset belongs to the organization. That feedback can help the next investigation avoid the same error.
This is an ongoing interaction between people and AI agents. The more useful context the team provides, the better the process becomes.
Measure speed before anything else
Megan: How can teams measure whether an AI SOC, autonomous SOC, or ISOC is improving over time?
David: We already have useful metrics in the SOC, so there’s no need to reinvent them.
- Mean Time to Detect, or MTTD, measures how long it takes to trigger an alert after events have been ingested. This is especially important as AI makes attacks move faster. Detection needs to happen within seconds. If detection takes five, 10, or 30 minutes, an attacker may already have made significant progress. Teams need to reduce MTTD as much as possible.
- Mean Time to Investigate, or MTTI, is another important metric. Before AI agents, an investigation could take 30 minutes or even two hours. If a team receives 100 alerts a day, that creates a significant workload, agents can compress the investigation time. Once the team has a reliable verdict, it can act quickly by contacting the right people, blocking a network connection, or suspending an account.
- Mean Time to Respond, or MTTR, measures how quickly the team can carry out that action. Playbooks can automate part of the response so the organization can move from a confirmed verdict to action within seconds.
Reduce alert fatigue
David: Alert fatigue has been a persistent problem in SOC teams. Analysts often have to handle a large number of alerts every day, many of which turn out to be false positives, unnecessary alerts, or accepted risks.
Automated triage can move those alerts into a separate category and compare them with the total alert volume. That gives teams a way to measure how much work the AI is removing from the process.
David cites a Sekoia triage score of around 94%. A score above 90% could reduce the team’s painful triage work by a factor of 10.
It's all about giving analysts more time for work that requires judgment and investigation.
Keep total cost of ownership visible
David: Another metric we should talk about is Total Cost of Ownership, or TCO, which measures what an organization spends to operate its SOC. That includes infrastructure and software, as well as the people operating the SOC.
Organizations can reduce headcount, but the decision has to match the number of attacks they face. If the volume of attacks increases by 1,000, reducing the team without changing the operating model won’t work. The right balance needs to be reviewed over time. Companies should be able to model the different costs of their SOC and test how new approaches change the equation.
I'm currently working on a framework that will help organizations measure their SOC’s TCO and understand where they can make changes.
A wider SOC market
David: The ISOC model is also designed to reduce the cost of operating a SOC. That could make security operations more accessible to smaller organizations.
Today, SOC capabilities are often built for large organizations or delivered to smaller organizations by Managed Security Service Providers, or MSSPs. An integrated model can reduce the size of the infrastructure and team required to deliver cybersecurity.
That would make it possible for more organizations to access strong security operations.
Conclusion
AI agents will change the way SOC teams work. They can process more activity at greater speed and take on the repetitive tasks that consume analyst time.
The human role will move toward judgment, skepticism, innovation, and mentorship. Analysts will need to understand how agents reach conclusions and have the ability to change the process when the environment demands it.
The next SOC will be built around collaboration between people and AI agents. The teams that prepare for that shift will be better positioned to respond as the attack surface expands.
Megan: Thank you for joining me and sharing your perspective.
David: Thank you, Megan. It was a pleasure.
This transcript is part of Sekoia’s Intelligence Asymmetry podcast, where cyber leaders, Sekoia’s experts, and partners share the thinking behind modern defense. Visit our YouTube channel to watch the full episode and explore the complete series.
