AI in the SOC: A Practical Plan for Analyst Collaboration

An analyst investigating one alert may spend much of the time collecting context from other tools. The endpoint record is in one system, authentication events are in another, and the previous incident is buried in a report. AI assistance is worth testing where it can help connect that material without obscuring the evidence.

The operational question is specific: which work can a system support reliably, and which decisions require an analyst who understands the organization?

Assign responsibility to each task

Start with a bounded workflow. An assistant might draft a timeline or suggest a hunt query. An analyst should verify the underlying events, test the query, and decide what the result means.

Work area	Possible AI contribution	Analyst responsibility
Alert triage	Collect context and summarize related observations	Validate the evidence and choose the response
Threat hunting	Draft queries and alternative hypotheses	Check syntax, data coverage, and findings
Incident response	Organize events into a proposed timeline	Confirm sequence, scope, and containment decisions
Knowledge management	Index and summarize incident artifacts	Correct the record and maintain playbooks
Reporting	Draft a brief with links to supporting material	Explain impact and preserve uncertainty

A system’s explanation is also generated output. It can help a reviewer understand a recommendation, but it is not proof that the recommendation is correct. Keep access to the original records.

Build the foundation before expanding

A first phase, perhaps over three months, should establish how the work is performed today. Measure time spent on enrichment, review effort, false positives, and missed findings. Define detection and response time consistently so later comparisons mean something.

Choose one pilot, such as alert enrichment. Establish approved data handling, tool permissions, logging, and a way to stop the workflow. Train analysts to recognize fabricated citations, misleading summaries, and inappropriate confidence.

During a subsequent integration phase, put the tested workflow into the playbook. State what the assistant may do, what requires review, and how errors are reported. Expansion into timelines, reporting, or knowledge search should follow evidence from the pilot.

The original roadmap allowed three to six months for integration, six to twelve for expansion, and continuing evaluation afterward. Treat those as planning ranges. Readiness should determine progression.

Make a comparison that can be inspected

Consider a timeline exercise using a known incident. In the existing process, an analyst collects records and reconstructs the sequence. In the assisted process, the system proposes a timeline with a source for every event.

Compare both against the reviewed incident record. Count omitted events, incorrect relationships, unsupported claims, and the time needed to correct them. A fast first draft can still create additional work if the analyst must reconstruct its reasoning.

Vendor case studies can suggest workflows to investigate. Performance percentages without a traceable source, baseline, and workload definition cannot establish what another SOC should expect. Use published research and a local evaluation to decide what to test.

Read the research within its scope

Albanese and colleagues’ human and machine teaming paper proposes a research direction in which assistants learn operational knowledge from analysts. It invites further collaboration to identify measurable gains. It does not report a general productivity result for deployed SOCs.

Mohsin and colleagues’ 2025 autonomy framework connects levels of automation with task risk and human oversight, using a simulated cyber range as an example. That provides a structure to evaluate, with limits on what simulation can establish about production operations.

Tariq and colleagues studied 58 participants performing phishing and intrusion detection tasks. They reported improvements in task performance and a learning effect after collaboration. The study supports further testing; its participants and tasks do not represent every SOC or incident.

Aydin’s “Think First, Verify Always” study reports a randomized trial with 151 participants and a roughly 7.87 percentage-point improvement on cognitive security tasks after a brief intervention. That is a result for the study’s task, not a measured reduction in incident response time.

Decide whether the pilot earned expansion

Set success criteria before reviewing the outcome. Include the quality of decisions, verification time, missed threats, and analyst workload. Track changes in the incoming workload so a quieter month is not mistaken for an AI benefit.

Retain analyst feedback in a controlled improvement process. Updating a prompt, changing a knowledge base, and retraining a model are different operations and should be evaluated separately.

A useful deployment leaves the team with a supported finding and a clear record of how it was reached. Expand when the evidence shows that the workflow achieves that result consistently.