While going through our AI for SecOps market research, one thing kept coming up as we reviewed the solutions out there: the basics are still necessary, no matter how much AI you slap on top. And in many cases, they don’t automagically resolve.
You’re probably thinking, “Yes Filip, anything new here?” Not much, honestly. But I wanted to clear something up.
The whole buzz and fuss around context DBs and context graphs is not new. The idea is not new. What changed is who consumes it, and that AI can now help build it from messy sources. Before, this context was built mainly for humans, and in the best case for some SOAR automation.
Product Updates
Agentic case management is the next layer of SecOps to get rebuilt. Think ITSM, built natively for security. Treat links every tool, and your policy, through one ontology of identity, network, and assets, so everything about the same asset lands in one case. General-purpose LLMs handle reasoning. Purpose-built Cyber Language Models handle the security context and the decision. When an employee asks to approve a new AI tool, Treat checks their identity, access, risk, your policy, and past decisions, then recommends the path: auto-resolve, your approval, or page on-call.
Treat measures success as Mean Time to Trusted Action.
Don’t Have to Choose Between Human Oversight and Automation.
Humans at the Helm means security teams can adopt and expand automation progressively, as verified outcomes accumulate, establishing credibility.
SOC teams oversee automations, configure agents and playbooks, and control investigations, evidence validation, and response. They make the critical decisions and can automate triage, workflows, and playbooks partially or fully, in stages or all at once, based on the evidence they need to build trust.
This is governed automation. This is the AI SOC done right.
No CMDB and IdP, no magic
So if you’re evaluating tools in this space, first things first. As Rafal Kitab mentioned, if you have a bad CMDB (and I’m not sure how many people can say they have a good one) and no proper inventory of your infrastructure and identities, then no AI SOC, ISOC, XDR, or AI-this-and-that will automagically save you.
To be fair, AI SOC tools can get part of the way there. They can query your EDR to learn about the host and your IdP to learn about the user. But in most cases that only gets you the technical facts. It doesn’t tell you who owns the box, how critical it is, or whether that service account is supposed to be doing what it’s doing. That’s business context, and it usually lives in a CMDB nobody updates, a spreadsheet, or someone’s head.
Institutional and tribal knowledge
OK, maybe there’s a tool that gathers all this institutional knowledge for you. And yes, there are some on the market. But even there, it’s a fine line. How much do you want to monitor your employees? To be honest, in many cases capturing all that knowledge requires some level of monitoring of how people work.
And if you’re in Europe, this isn’t only an ethics question. It’s GDPR. In some countries, like Germany, works councils also have a say on monitoring tools. So check with legal before you sign anything that watches your analysts work.
Then there’s tribal knowledge. Sorry to tell you, there is no easy way to capture that one. Unless you want to try extortion :D
The only realistic way is slowly, through feedback. Every time an analyst corrects the AI, overrides a verdict, or adds context it missed, that’s tribal knowledge leaking into the system. If your AI SOC has no proper feedback loop, it will never learn the stuff that isn’t written down.
Humans are bad at documentation
Also keep in mind how most of this was built in the past. It was done by humans or by automation. And text generation wasn’t great back then, unless you invested heavily in NLP/ML stuff.
Humans are bad at documenting stuff. We’re even worse at keeping that documentation accurate. At one of my previous jobs, we had a person whose only job was writing and maintaining documentation. It was pretty good while they did it. Then they left and it all fell to pieces again.
And a lot of what we call process isn’t documented at all.
Your alert history is not ground truth
Same with alerts. If you’ve ever done QA on past alerts closed by humans, you know what you get. The usual one-liners: “Normal activity.” “Expected.” “Closing as FP.” Incidents might be better, because someone was forced to do a post-mortem and write an actual executive summary of the investigation.
Here’s why this matters for AI SOC. If the tool uses your past dispositions as memory or as ground truth, it inherits those labels. “Closing FP” with zero reasoning becomes something the AI learns from. Garbage labels in, confident garbage out.
So before you let any AI learn from your history, ask yourself honestly how much of that history you’d trust.
Ground rules
So let’s set some ground rules. Or just state the obvious, in case you missed the memo.
1. No good asset and identity context, no AI SOC magic. The AI can pull a lot from your EDR and IdP, but it won’t know who owns the box, how critical it is, or whether that service account is supposed to do that. There’s no magic button for this. You need to organize and document your data well.
2. Your documentation was built for humans, and often badly, by humans. Once you add AI, it will take time for the AI to document things properly and turn them into a good, machine-readable format. (Check my older blog on why your playbooks were not created for machines: [link])
3. LLMs don’t “know” threats they weren’t trained on. ML can flag abnormal behaviour, but only against a baseline. If you don’t know what normal looks like in your org, and you don’t have good change and exception management, you’re doomed. You’ll get flooded with FPs, or even worse, miss the TPs.
Final Thoughts
AI SOC doesn’t replace the basics. It runs on them.
Fix your asset and identity data first. The AI part gets a lot easier after that.
SecOps Unpacked Webcast Episode on Machine Speed vs Machine Focus
Check out our SecOps Market Landscape tracker and evaluation frameworks