The State of AI in the SOC 2025 - Insights from Recent Study

A new survey of 282 security leaders across industries paints a stark picture of SOCs under pressure, with alert volumes pushing teams to leave critical threats uninvestigated. On average, organisations process 960 alerts per day, and large enterprises handle over 3,000 daily alerts from about 30 alert-generating tools.

Investigations are slow, taking an average of 70 minutes to fully investigate an alert and 56 minutes before any action is taken, creating unacceptable delays for high-priority incidents such as a Business Email Compromise case cited in the report. The perceived cost of the overload is borne by not just burnout but a measurable risk, with 40% of alerts going uninvestigated and 61% of security teams admitting to ignoring alerts later proven critical.

AI adoption is accelerating, with 55% of security teams already deploying AI copilots and assistants in production, and 60% of teams not yet using AI planning to evaluate AI-powered SOC solutions within the year; the survey projects 60% of all SOC workloads being handled by AI in the next three years.

The findings also show where AI is most valued—triage (67%), detection tuning (65%), and threat hunting (64%)—as organisations aim to surface meaningful alerts and context while reducing manual effort, according to the study. The report highlights a future hybrid SOC where AI handles routine analysis and humans focus on complex investigations, with success metrics centred on MTDI and MTTR alongside upskilling SOC staff.

According to the latest CrowdStrike Cyber Threat Report, the need for rapid, accurate response under pressure remains a driving force behind these shifts.