In Response to AI SOC Analysts

(https://www.dhirubhai.net/feed/update/urn:li:activity:7244394341446680576/) by Shayan Shafii @ Scale Venture Partners

Why it Matters: The rapid evolution of artificial intelligence (AI) has had a profound impact on the cybersecurity landscape. Threat actors have been early adopters of AI, using it to scale and enhance their attacks, such as hyper-personalized phishing, AI-generated malicious scripts, and automated attacks. At the same time, Security Operations Centers (SOCs) are struggling to keep up, overwhelmed by a flood of alerts, complex environments, and understaffing. The need for AI to assist and augment SOCs in defending against these threats is critical to maintaining enterprise security.

Actions for SOC leadership:

-Adopt AI Tools for Defense: Security teams must embrace AI-driven tools, such as AI Analysts, to level the playing field against AI-enabled attackers. SOCs can significantly improve efficiency by automating tier 1 and tier 2 analyst tasks and decisions.

-Invest in AI Training and Integration: Ensure your organization invests in both the integration of AI solutions across diverse environments and the upskilling of human analysts to effectively use AI.

-Plan for Hybrid Approaches: Adopt a strategy that balances AI automation with human oversight. While full autonomy may not be achievable in the short term, AI-assisted human analysts can offer a best-of-both-worlds approach.

I decided to organized this post: The Two Pillars of AI in Cybersecurity

1. AI for Security: Enhancing Defense with AI Analysts

The Evolving Threat Landscape Operating a SOC has always been challenging, but the last two years have seen an explosion of AI-driven threats. Adversaries are leveraging AI, particularly large language models (LLMs), to create sophisticated attacks that include:

Hyper-personalized phishing emails

AI-generated malicious scripts

Pre-built agents capable of executing complex attacks on-demand

With these advancements, SOCs are now dealing with attacks that scale faster and evolve more unpredictably than ever before.

Challenges for SOC Analysts SOCs are traditionally structured in three tiers of analysts, each with distinct roles:

Tier 1 Analysts: The first line of defense, triaging alerts and deciding whether they represent a legitimate threat.

Tier 2 Analysts: More experienced, responsible for conducting in-depth investigations once a threat is identified.

Tier 3 Analysts: Threat hunters who proactively search for vulnerabilities and attack vectors before an incident occurs.

SOCs are overloaded with a staggering volume of alerts, often processing only about half of the 4,500 alerts generated daily, and analysts face a complex web of environments to investigate (cloud, endpoints, identity platforms, etc.). This overwhelming workload leads to high turnover and loss of institutional knowledge, making it harder to effectively protect the organization.

AI to the Rescue: Introducing AI SOC Analysts The introduction of AI into the SOC, specifically through AI-powered analysts, offers a solution. AI Analysts are now capable of automating a significant portion of the SOC workflow:

Alert Comprehension: AI Analysts can ingest alerts from a variety of systems (e.g., CrowdStrike, AWS GuardDuty) and extract essential details such as suspicious IP addresses or user identities.

Task Planning: AI can generate investigation plans tailored to each type of alert, much like how a human would decide what to do (Arcanna).

Task Execution: Using code generation and integration with internal tools, AI Analysts can gather relevant data (e.g., API calls, database queries) to investigate alerts.

Adjusting Based on Clues: AI Analysts can adapt as they discover new information, adding steps to the investigation based on clues found in earlier stages.

Reaching Conclusions: AI can autonomously classify alerts as malicious or benign by following this recursive investigative process (Arcanna - No LLM required).

Transparency: AI Analysts can show their work, detailing every step of their investigation, much like a human would for audit purposes. (AI Explainability is key)

With AI handling much of the mundane and repetitive investigative work, SOCs can shift from being reactive to proactive, improving response times and reducing human error.

2. (Securing AI: Ensuring the Safety of AI Systems)

The Dual Role of AI While AI offers transformative benefits to SOCs, it also introduces new risks. Adversaries are not only using AI to attack organizations, but they are also targeting AI systems themselves. Securing AI systems becomes just as important as using AI for security purposes.

I have identified 115 different software solutions for securing AI, I have broken down to 15 categories, Security, Privacy, Guardrails, MLOPS, Infrastructure Protection, RAG or LLM evaluation, AI Governance and more.

Few Key Considerations for Securing AI:

Model Exploitation: AI models, particularly LLMs, can be manipulated by attackers through data poisoning or adversarial inputs, leading to incorrect responses or vulnerabilities.

Privacy and Bias Concerns: AI systems processing sensitive data are vulnerable to privacy violations and biased decision-making, which can be exploited by malicious actors.

Supply Chain Risks: The algorithms and data that feed AI systems may have vulnerabilities in the supply chain, creating a need for comprehensive AI governance.

Actionable Steps to Secure AI:

Regular Auditing of AI Systems: Perform continuous audits of AI systems to detect any manipulation or vulnerabilities.

Implement AI Governance: Establish a robust framework for AI governance to ensure transparency, accountability, and security throughout the AI lifecycle.

Monitoring AI Interactions: Ensure that AI tools operating in SOCs and beyond are closely monitored to detect any deviations from expected behavior, which could signal an exploit.

The Future: Balancing AI Automation with Human Oversight

As AI becomes more integrated into cybersecurity operations, organizations face key decisions around how much autonomy to give AI versus keeping humans in the loop. While full Level 5 autonomy—where AI systems can independently handle all tasks—is the ideal, a hybrid approach that combines human analysts with AI support is likely the most practical for the foreseeable future.

My closing thoughts:

Accuracy and Trust: How accurate are AI systems in detecting and investigating incidents? Building trust in AI capabilities will be essential, especially in high-stakes environments like SOCs.

Mean Time to Decision a new type of (MTTD) : There are many decisions that need to happen in a SOC, understanding decision timing in many areas is key. Drop or Escalate, Investigate, Create a Ticket, Who should own the ticket, Who should remedy the issue. Who is the right person for approval. Decision Intelligence is needed in every step along the way.

Mean Time to Recovery (MTTR): SOCs are measured by how quickly they can close incidents. AI’s ability to accelerate this process by automating routine tasks can significantly reduce MTTR.

Depth of Integrations: The success of AI SOC Analysts hinges on deep integration with the myriad of tools SOCs use, from security platforms to internal knowledge bases. The ability to interface with various data sources will be a key differentiator among vendors.