AI Emerges as the Hope—and Risk—for Overloaded SOCs

With security teams overwhelmed by alerts, the SecurityWeek piece cites a Prophet Security analysis of 282 security leaders from companies with more than 1,000 employees, primarily in the United States, showing SMEs receive around 500 alerts a day and larger enterprises about 3,000, yet 40% are never investigated and 57% suppress their detection rules to reduce load.

The article notes that 55% already use some form of AI for alert triage and investigation, while 60% plan to evaluate an AI SOC solution within the next year, and 83% believe more than half of the SOC workload will be completed by AI in the next three years. The three main use cases anticipated for AI in the SOC are alert triage and investigation (67%), detection engineering and tuning (65%), and threat hunting (64%), with remediation and incident containment at 43%.

It also highlights that organisations contend with an average of 17 alert-generating tools, and often more than 20 in larger firms, which fuels alert fatigue and raises concerns about human oversight and explainability. according to Prophet Security.