AI is moving incredibly fast, and every security leader is feeling the pressure to keep up.
AI platforms like Claude, Codex and Cursor are already helping security teams write detections, investigate alerts, summarize incidents, and automate repetitive work. The conversation has evolved from whether AI belongs in the SOC, to where each type of AI delivers the most value.
With so many new AI products entering the market, it’s easy to assume one tool can solve every problem. In reality, different types of AI are designed for different jobs.
Understanding that difference is what transforms AI FOMO into better security outcomes.
AI is changing security operations
The way security teams work is changing quickly.
Attackers are already using AI to generate phishing campaigns, automate malware development, and move faster than ever before. At the same time, defenders are using AI to triage alerts, create detection rules, automate reporting, and simply reduce manual work in general.
The opportunity is enormous.
The challenge is deciding where each type of AI fits into the SOC.
Two kinds of AI, two different jobs
The easiest way to think about modern security operations is as three layers.
At the bottom are your existing security tools such as your SIEM, EDR, cloud security, identity platforms, email security, and everything else generating alerts.
In the middle is an autonomous AI SOC. Its job is to investigate every alert automatically, correlate findings across tools, apply organizational context, and most importantly, determine which alerts actually require human attention.
At the top are AI platforms like Claude, Cursor, and Codex. These are where analysts, detection engineers, and incident responders collaborate with AI to solve problems, write detections, create reports, hunt for threats, and make decisions.
These layers are all complementary and necessary for a successful SOC.
Why AI platforms like Claude shouldn’t investigate every alert
AI platforms are incredibly capable, but they’re designed to help people.
An analyst can ask Claude to explain suspicious PowerShell activity, summarize an investigation, draft a Sigma rule, or translate a detection into another query language. Those are excellent uses of AI.
But investigating thousands of alerts every day is a different challenge.
That kind of work needs an autonomous system that runs continuously, integrates with security tools, remembers organizational context, and investigates alerts around the clock without waiting for a human prompt.
Trying to use an AI platform as a 24/7 SOC investigator is a bit like asking a brilliant consultant to answer every phone call in a busy call center. The consultant is extremely valuable, but only when they’re focused on the work that benefits from their expertise.
The tokenomics problem
There’s another reason AI platforms aren’t designed to investigate every security alert: economics.
Every investigation starts with context. An AI model needs endpoint telemetry, process trees, authentication logs, email history, threat intelligence, previous investigations, detection rules, and organizational knowledge before it can make a good decision.
Every piece of that context consumes tokens.
That’s perfectly reasonable when an analyst asks Claude to help investigate a handful of incidents each day.
It becomes a very different equation when a SOC receives thousands of alerts every day.
Imagine using a large language model to perform a fresh investigation for every alert. Even if each investigation were relatively small, the organization would still be paying for tens of thousands of AI conversations every day, most of which would conclude that the alert is benign. As alert volume grows, the cost grows with it.
Enter the autonomous AI SOC.
Instead of treating every alert as a brand-new conversation with a large language model, a good AI SOC combines deterministic workflows, forensic analysis, organizational memory, cached context, and selective AI reasoning. Large language models are used where they add value, not for every step of every investigation.
The result is an architecture that can investigate every alert continuously while keeping costs predictable.
Using Claude to investigate every alert is a bit like using a Formula 1 car to deliver packages. It’s an incredible piece of engineering, but it was designed for speed, not high-volume logistics. Enterprise SOCs need infrastructure built to handle enormous scale efficiently, with AI applied where it has the greatest impact.
The MDR reality
There’s another practical challenge that often gets overlooked.
Many organizations don’t operate their own SOC. They rely on a MDR provider to monitor their environment.
In those environments, the MDR typically owns the investigation workflow. They have the analysts, the case management system, the investigation history, and often the enriched telemetry collected during the investigation. The customer usually receives only the escalated incidents and periodic reports, not every piece of evidence gathered along the way.
That makes it difficult for an AI platform like Claude to independently investigate alerts, because it doesn’t have access to the same information the MDR is using.
Even if an organization wanted to build its own AI-assisted investigation workflow, it would first need the raw alerts, telemetry, investigation artifacts, and historical context that often remain inside the MDR’s platform.
AI platforms are incredibly valuable once information is available to them, but they can’t reason over data they don’t have.
This is another reason autonomous AI SOC are becoming an important architectural layer. They sit directly alongside the organization’s security tools, investigate alerts as they arrive, retain organizational context, and make that knowledge available to both analysts and AI platforms.
Instead of replacing MDRs overnight, they give organizations a path toward owning their investigations, their institutional knowledge, and ultimately their security operations.
Investigating 100% of alerts?
Most security teams simply don’t have the capacity to investigate every alert they receive.
As a result, they prioritize the highest-severity alerts while lower-severity alerts often receive less attention.
The problem is that severity doesn’t always reflect risk.
Analysis of more than 25 million security alerts processed during 2025 found that nearly 1% of confirmed incidents originated from low-severity or informational alerts. The conclusion is straightforward, meaningful threats can begin anywhere in the alert stream.
But the answer isn’t asking analysts to work harder. It’s giving them more capacity.
An autonomous AI SOC creates that capacity by investigating every alert, not just the loudest ones, while escalating only the cases that truly need human judgment.
Where Claude and friends shine
Once an autonomous AI SOC has completed the investigation, AI platforms become even more valuable.
Instead of spending time gathering evidence from multiple consoles, analysts can use an AI platform to focus on higher-value work.
They can:
- Ask questions about completed investigations.
- Draft and refine detection rules.
- Hunt for emerging threats.
- Summarize investigations for stakeholders.
- Generate incident reports.
- Explore new hypotheses.
- Make the final decisions on complex cases.
In other words, the autonomous AI SOC handles the grind of triaging endless alerts and repetitive investigation.
The AI platform helps people think, create, and decide based on everything the AI SOC has provided.
Better together
The biggest takeaway isn’t that organizations need to choose between an autonomous AI SOC and AI platforms like Claude.
They need both.
One continuously investigates alerts across the environment.
The other helps security professionals work faster and make better decisions.
Together they create a model where machines handle repetitive investigation while humans focus on strategy, judgment, and continuous improvement.
Join Intezer’s Co-Founder and CEO, Itai Tevet, and CMO Lital Asher-Dotan for a real conversation (not another stuffy webinar) about where AI actually fits in security operations today. With so many AI platforms competing for attention, Itai and Lital will cut through the noise and get specific about what to use where, based on real examples.
Three takeaways:
- Why AI platforms like Claude are built to help people, not investigate every alert at scale
- How the “tokenomics” of AI investigation change the math for high volume SOCs
- Where an autonomous AI SOC and AI platforms complement each other
![An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner [Guest Diary]](https://cybersecnextgen.com/wp-content/uploads/2026/07/An-SSH-Bot-That-Sizes-Up-Your-Hardware-Before-Deploying.png)
Leave A Comment