AI in the SOC — Social

Social

What practitioners are saying on X, Bluesky, Reddit and LinkedIn, newest first, and the most shared posts.

@beenu_a on X · 22 Oct 2026

#AiSOC v20 now pulls threat intel straight from #OpenCTI, and alerts from #Lacework, #Tines, #Datadog and #PagerDuty keep their native severity. They all came from OSS community. This is exactly how I hoped the project would grow.

@Sixth_Sense888 on X · 22 Oct 2026

AI is entering the "AI vs AI" phase where it is used by both attackers and defenders, and traditional 24-hour human monitoring (SOC) cannot keep up with the speed of AI attacks, so there is a lot of interest in companies where "AI agents automatically detect and immediately…

@hendryadrian.bsky.social on Bluesky · 21 Oct 2026

Zimperium’s integration with Sekoia brings mobile threat telemetry into its SOC platform for investigation alongside other security data. Sekoia says Elevate AI agents can correlate evidence and produce reviewable findings, with analysts retaining decision-making.

@Just-Maximum-5679 on Reddit · 21 Oct 2026

I wonder how many of you regularly let your AI SOC close alerts on its own. I find that I trust the verdicts much more when I review them.

@Only-Brain-8961 on Reddit · 21 Oct 2026

We moved off XSOAR and shortlisted Torq, Dropzone, Prophet and Mate. Expected a fairly clean cutover with minimal disruption. Actual outcome was a rougher few weeks than planned, mostly because of things nobody flagged ahead of time.

@Prestigious_Cat_6281 on Reddit · 21 Oct 2026

We run a six person SOC on Sentinel and CrowdStrike, and leadership wants an AI SOC analyst tool in next year’s budget. I’ve sat through demos from Dropzone, Prophet, 7AI and Mate, and on the canned phishing alert they all look great. Week six worries me more than the demo.

@SIMDetroit on X · 21 Oct 2026

A strong start in Detroit. 🎤 Rob Salafia opened the Summit with \"Leading Rapid Change with Poise and Presence\" — a reminder that how a leader shows up under pressure shapes everything that follows.

@hacker.at.thenote.app on Bluesky · 21 Oct 2026

Abstract links automated response actions directly to SIEM detection rules Abstract has announced new AI SOC capabilities in its agentic SIEM: investigation, hunt, and triage powered by a combination of Abstract’s own trained and tuned models and frontier foundation models, and…

@Program47 on X · 21 Oct 2026

i Built my own SOC automation platform using machine learning and reinforcement learning where every case and event feeds a continuous learning loop to improve future analysis, detection, and decision making. I’m also developing an isolated malware analysis sandbox

@pirate_sec on X · 21 Oct 2026

Panther has a great alert triage/investigative agent too. But if it was a human IR analyst, they’d be fired in a week lol. Great at gathering context. Not so great at making correct judgements off that context.

@WebLinkr on Reddit · 20 Oct 2026

Key points from the discussion: * Medical analogy / T-shaped skills: Similar to AI’s impact in medicine, the shift favors T-shaped people—deep specialists who also understand the broader system.

@WebLinkr on Reddit · 19 Oct 2026

* 😩 Most teams are overworked and just accept the risk * 🤝 Many already augment with MSSPs or MDR services * 🔧 AI SOC fills gaps that were treated as unavoidable * ✅ Clear win: Better MDR or less need for outsourced humans * 🚀 Bigger opportunity: Supercharge the internal team…

@WebLinkr on Reddit · 19 Oct 2026

* 📢 Extremely noisy market * 🔢 \\~60 AI SOC vendors (per one analyst) * 🎤 \\~75% of Black Hat floor was talking about AI SOC * ⚔️ Legacy players + startups all trying to shape the category * 🎯 Buyer challenge: demand more and define what *you* actually need * 🚫 Don’t let vendors…

@WebLinkr on Reddit · 19 Oct 2026

Key Points from the Video * Core benefit summarized in two words: Machine speed * Summer 2026 marked a watershed moment for security organizations as attackers (including nation-state level) gained the ability to execute attacks at machine speed * Traditional security tools are…

@z3usalmighty.bsky.social on Bluesky · 19 Oct 2026

The economics of alert triage just changed: at $42 per billion input tokens, you can run a decision model on every alert. But cheap inference doesn't fix bad evidence. 51% of machines with active infections were already marked mitigated by EDR.

@newsen.bsky.social on Bluesky · 19 Oct 2026

Exaforce Named Progressive Player in AI-Security Operations Market Recognition #United_States #Delray_Beach #AI_Security #Cyber_Threats #Exaforce

@l0rdmalware on X · 18 Oct 2026

Google bets on "Agentic SOC" with Gemini: agents that investigate alerts and automate remediation, plus Gemini in Google Threat Intelligence to consult Mandiant intelligence. It's a commercial solution. #cybersecurity #ThreatIntel https://t.co/adJmpP0t9p

@constellationr on X · 18 Oct 2026

Agentic SOC is emerging as a new operating model for security operations. Modern attacks move across identities, endpoints, #cloud, APIs, and #AI systems, but most SOCs still operate in silos.

@yogsec.bsky.social on Bluesky · 18 Oct 2026

Talahon is an autonomous SOC analyst agent built for SOCfortress CoPilot. It automatically investigates alerts, enriches IOCs, and writes findings back to the system using Claude and local LLMs. GitHub: github.com/Liohtml/tala... #SOC #AIAgent #Cybersecurity #OpenSource #InfoSec

@sec-news-bot.bsky.social on Bluesky · 17 Oct 2026

AI SOC platform's determination model, 51% of infected terminals misdetected? The AI determination model can reduce the cost of SOC triage, but an actual survey found that 51% of infected terminals were misidentified as "responded" by EDR.

@arc-codex.com on Bluesky · 17 Oct 2026

How the Aurora Superintelligence Platform and Aurora Agentic SOC Help You Understand and Secure AI This article heavily frames "visibility" as the ultimate solution to trust issues in AI security operations.

@aws-news.com on Bluesky · 16 Oct 2026

Arctic Wolf's Aurora Agentic SOC, available in AWS Marketplace, combines AI agents with human experts to resolve security alerts faster by integrating with AWS Security Hub and other AWS services.

@sansforensics on X · 16 Oct 2026

Finding real threats among thousands of alerts takes time. At #DFIRSummit, Luis Garcia of Daylight Security showed how AI agents can help identify suspicious activity while analysts validate the evidence.

@cybermaster77.bsky.social on Bluesky · 16 Oct 2026

AI Decision Models and Their Impact on AI SOC Platforms https://thehackernews.com/2026/10/ai-decision-models-and-their-impact-on.html #CyberSecurity #InfoSec

@thedatatechtimes.bsky.social on Bluesky · 16 Oct 2026

Sekoia's Elevate autonomous SOC layer completed 425,000 investigations in early access, delivering audit-ready verdicts in 99 seconds. The infrastructure implication: analyst time collapsing from hours to under two minutes per incident.

@anton_chuvakin on X · 16 Oct 2026

Google’s Gemini 4 Argon absolutely cooked in this Agentic SOC benchmark 🍳🔥 We saw a significant leap with Astra in accurately linking evidence to the final verdict. Gemini blew right past that. @Google @GeminiApp

@devops-daily.com on Bluesky · 15 Oct 2026

📝 Page, Ticket or Ignore: Is the Cheap Model Good Enough for Alert Triage? We gave six models and two model routers on DigitalOcean Serverless Inference one written on-call policy and 200 alerts, three times each.

@CisoMarketplace on X · 15 Oct 2026

CISOs: vetting an AI SOC vendor this Cyber Awareness Month? Ask what happens when the model is wrong, not just when it's right. Briefing on due diligence gaps most RFPs miss. https://t.co/bEWNfm9rCg #CISO #AISecurity https://t.co/PDvKV7SEK5

@XSeyvion on X · 14 Oct 2026

Artemis Security just put out Orion 1, a cyber defense model built for defenders. They say general models keep tightening cyber outputs. That pushes blue teams into a weird spot where the safety layer blocks the work.

@VMG_CU on X · 14 Oct 2026

It's changing the skills, not deleting the seats. AI eats alert triage and first-pass writeups; the scarce skill is deciding what an agent may touch and proving it didn't invent a finding. Budget that moves from L1 hours into control design is the real tell.

@jamesbower on X · 14 Oct 2026

Your AI SOC agent should make one call, not all of them. Here’s how to build a Tier 1 triage agent in LangGraph that escalates when it’s unsure. You can run it with no API key. https://t.co/bsdDdf6BHm

@CRN on X · 14 Oct 2026

The dramatic shift to AI-driven security operations now underway is creating an opportunity to build a vendor on the scale of the cybersecurity industry giants—an ambitious goal that agentic Security Operations Center (SOC) startup 7AI is pursuing by focusing its growth strategy…

@aidailypost.com on Bluesky · 14 Oct 2026

Orion-1 just exposed a blind spot—its AI guardrails are blocking the defenders who need to see log anomalies. See how Claude, GPT models, and Artemis Security are reshaping intrusion detection and log analysis.

@ai-sight.bsky.social on Bluesky · 14 Oct 2026

Artemis Security has made a model available to selected clients that combines data from company systems and reconstructs the course of incidents.

@ZackKorman on X · 14 Oct 2026

People think it’s not controversial because they underestimate what I mean. I really mean LLMs will take over being the source of detection. Not alert triage. Not writing detection rules. Just throw tokens at logs

@VitaliiT76597 on X · 14 Oct 2026

Sophos cut threat investigation time from 38 min to 89 sec using OpenAI Daybreak AI agents — a 96% reduction. ⦿ What this means for SOC automation strategy is worth a close look? #Sophos #SOCAutomation https://t.co/DLrk2azUAf

@sipirtu.com on Bluesky · 14 Oct 2026

Trellix announced Trellix Wise for Private Cloud, an on-premises, federated AI core for the agentic SOC. Source: Techxmedia

@gastronomy on X · 14 Oct 2026

From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage: Security operations centers (SOCs) must triage large volumes of alerts, most of which are benign, while missed attacks can remain uninvestigated.

@duncanriley on X · 13 Oct 2026

Trellix Wise for Private Cloud runs AI security operations inside customer environments https://t.co/7l4qJy6NMz via @SiliconANGLE

@0xYinji on X · 13 Oct 2026

What did the cyber defenders evaluate: alert triage, incident investigation, or code review? A public task set with failure cases would help show where Argon is useful.

@augustine767121 on X · 13 Oct 2026

what do you think of the chances of success for a newer class of models to coexist with LLMs, or be leveraged in some sort of swarm architecture? e.g. decision models or one of the newer proprietary cyber defense models like Orion-1 just released by Artemis Security.

@arc-codex.com on Bluesky · 13 Oct 2026

Agentic SOC: Why Your AI Strategy Will Live or Die on Data This article strongly emphasizes that "investigation-grade data" is the only foundation for Agentic SOCs, yet it frames the transition as purely an architectural prerequisite rather than acknowledging the significant…

@hapsis.bsky.social on Bluesky · 13 Oct 2026

Trellix Wise for Private Cloud delivers auditable AI investigations for security teams www.helpnetsecurity.com/2026/10/13/t... #Cybersecurity #AI

@jamesbower on X · 13 Oct 2026

Most people give their AI SOC agent too much power. In my build, the model makes one judgment and plain code makes every decision. I even tried to trick it with a hostile alert. Read the post to see what happened: https://t.co/bsdDdf6BHm

@scrblanc on X · 13 Oct 2026

autonomous soc agents fail on eval, not reasoning: ground truth arrives days later via incident reports, so you're scoring decisions against labels that don't exist yet. most demos never price that in.

@CRN_Deutschland on X · 13 Oct 2026

Nick Schneider, CEO of IT security company Arctic Wolf, announced upcoming innovations at the CRN XChange conference in Atlanta that are meant to automate most processes and tasks in a Security Operations Center (SOC). Security-... https://t.co/KIOifHaLQh

@_cybersecurity_ on Reddit · 13 Oct 2026

**A defense company that builds unmanned aircraft turned scattered security data and scripts into an automated security operations center using AI coding agents.** Most organizations assume a mature SOC requires an expensive security operations platform and a large team.

@LesOttolenghi on X · 12 Oct 2026

AI is taking the low-value security work: alert triage, enrichment, first-pass correlation. Analysts move from lookups to judgment. Boards will ask how you know the model is right. Rewrite the roles and budget for the transition, not just the tool. https://t.co/yBJXCGM85G

@Comfortale-sEast1511 on Reddit · 12 Oct 2026

Our SOC is buried in alerts, so I’m looking at Agentic SOC solutions, but I’m stuck on how teams control autonomous triage and response without losing the human review part. Any practical lessons?

@UndercodeUpdate on X · 10 Oct 2026

🛡️ Anthropic Enters Security Operations With Dual Defense Programs and Agentic SOC Tooling + Video -Prediction: 📈 1 Positive | 📉 0 Negative https://t.co/hb8ANmq8UO Educational Purposes!

@hacker.at.thenote.app on Bluesky · 9 Oct 2026

Mate Security Wins 2026 CyberSecurity Breakthrough Award for Agentic Cyberdefense Mate Security won a 2026 CyberSecurity Breakthrough Award for its agentic cyberdefense platform, combining organizational context with autonomous response. #hackernews #news

@4A4556494C on X · 9 Oct 2026

The SOC agent reliability paper is the one I wish every CISO would read before signing that \"AI-powered alert triage\" contract.

@cscr-bot.bsky.social on Bluesky · 9 Oct 2026

Saimon Amanuel Tsegai, Alex Kantchelian, Danfeng, Yao, Peng Gao: From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage https://arxiv.org/abs/2610.10608 https://arxiv.org/pdf/2610.10608 https://arxiv.org/html/2610.10608

@AIHorizonBlog on X · 9 Oct 2026

No. 2 in today's top 5: a new paper shows a two-layer defense that takes a SOC alert-triage LLM's injection detection from 25% recall to 94.5%.

@bigearthdata.ai on Bluesky · 9 Oct 2026

Elastic's AlertZero puts AI agents to work on security alert overload ->SiliconANGLE | More on "AI agents for security operations" at BigEarthData.ai | #AI

@arc-codex.com on Bluesky · 8 Oct 2026

Admin in the Loop: Firewalls and the Agentic SOC This article strongly frames the architectural shift as a necessary evolution, yet it underplays the inherent friction involved in mandating such tight integration across disparate vendor systems like Cisco and Splunk. How d...

@CyberTech_In on X · 8 Oct 2026

Your first autonomous SOC project should prove governance, not maximum autonomy. One bounded workflow. Clear identity. Explicit decision rights. Evidence. Failure testing. Recovery. Measurement. Read More: https://t.co/2DtJDMxXHr #AutonomousSOC #CISO https://t.co/XvJlir0WVI

@wowwowai on X · 8 Oct 2026

Too cool! Security AI "Cotool" is adding a flow that allows the "internal situation" confirmed by a person to be used for the next alert investigation in v0.73.0, without requiring the person to confirm it every time.

@undercode_news on X · 8 Oct 2026

🛡️ Agentic SOC at Splunk conf26 Shows How #AI Can Accelerate Security Without Replacing Human Analysts -Fact Checker: ✅: 6 ❌: 0 || 6/6 → Score: 100% 🦾 -Prediction: 📈 4 Positive | 📉 1 Negative https://t.co/wsgqdIm32T

@ItsReallyNick on X · 8 Oct 2026

New AI SOC startup just* dropped: “incorporating predictive analytics and machine learning into the SOC workflow can help augment the productivity of analysts, free up time, and ensure they utilize investigative skills and creativity on the threats that truly require expertise”…

@fjhuerta.bsky.social on Bluesky · 7 Oct 2026

Watch this video to see how an AI SOC conquers massive alert surges! 🚀 W.W. Grainger, @TENEXAI & Google SecOps scaled with JP Calabio & Edwin Solis: 📈 Managed 4k% more alerts 🤖 Added Gemini 🛡️ Hunted threats 🔗 Watch: www.youtube.com/watch?v=AtSuP17t1v4&t

@ConsultCRA on X · 7 Oct 2026

Enterprise IT leaders in the UAE emphasize that while agentic AI accelerates alert triage and log analysis to machine speed, organizations cannot afford to remove human judgment and zero-trust controls from high-impact operational systems. 🤖 🔗 https://t.co/WV6hXIUmbm...

@exabeam on X · 7 Oct 2026

Cyber Magazine looks at how Exabeam is advancing the Agentic SOC, including Exabeam Nova triaging an average case in about 10 minutes, 30x faster than a human analyst. https://t.co/Sp7kGcl1xv

@epochster on X · 7 Oct 2026

Can't wait for cohort 3's fourteenth 'autonomous SOC analyst' startup. Agentic security is a people problem long before it's an infra problem, and none of these credits train a single operator.

@exabeam on X · 6 Oct 2026

Duncan Riley at @SiliconANGLE looks at how Exabeam is pushing security operations toward persistent AI-assisted investigation, with human judgment still central to prioritization and response across cloud and on-premises environments. https://t.co/qLXuc7UGPB

@TechRevolt_News on X · 6 Oct 2026

In a contributed article for Tech Revolt, @Trellix 's @mcholste says AI may swap alert fatigue for token fatigue, and quiet threats that wait to strike are the other breaking point. https://t.co/yuRHsdTcap https://t.co/tTtnIvOGUo

@Imply_JP on X · 6 Oct 2026

AI SOC often surprisingly overlooks "log coverage" and "search speed." Even if the agent operates at high speed, if the search is slow, the necessary information may not be gathered, leading to a risk of generating hallucinations based on incomplete data.

@SecWeekly on X · 5 Oct 2026

Calling something an “AI SOC” doesn't explain how the platform actually works. Aqsa Taylor explains why security agents need reliable data and context before LLMs and autonomous agents can operate effectively.

@WillTownTech on X · 5 Oct 2026

As October kicks off @CISAgov Security Awareness Month - the security operations center in the near term and future will be decidedly agentic to keep machine speed pace with the weaponization of Al.

@TechstrongTV on X · 5 Oct 2026

AI security investigations need speed, structure and human judgment. Alan Shimel talks with Dov Yoran of Command Zero about 2027 CISO budgets and repeatable SOC workflows. Watch: https://t.co/kPEqWbRaHR #AI https://t.co/bZl0Nx9uLp

@Grandangolo_PR on X · 5 Oct 2026

Agentic SOC, dai dati alla risposta automatizzata agli attacchi @SentinelOne https://t.co/DJ6kVwO9SC

@runtimewire.bsky.social on Bluesky · 4 Oct 2026

Cotool turns security investigations into reusable AI agents, offering a no-code agent builder to capture repeatable investigator judgment. runtimewire.com/article/coto...

@cloudgooru.bsky.social on Bluesky · 4 Oct 2026

I've been watching $CRWD and notice CrowdStrike replatform Falcon to multitenant MLOps, model-as-service, agentic SOC. Infra-first AI rerates +40% in 12m. analysi.

@nyike on X · 4 Oct 2026

RT Splunk's AI-era vision, three focus areas: observability for AI, the Agentic SOC, and a rebranded data fabric. Same telemetry platform, three new problems to solve. #Splunkconf26 #AIOps @Star_CIO https://t.co/jjtHBWwpNY

@arc-codex.com on Bluesky · 4 Oct 2026

Beyond Triage: How the Aurora Agentic SOC Enhances the Concierge Experience This article frames the enhanced efficiency around customer context as a direct outcome of AI integration, but it downplays the inherent difficulty and ongoing human effort required to truly build that…

@bigearthdata.ai on Bluesky · 3 Oct 2026

Exabeam's Nova AI agent becomes a persistent investigator as LogRhythm gets AI updates ->SiliconANGLE | More on "AI agents transforming security operations" at BigEarthData.ai | #AI

@flo7up.bsky.social on Bluesky · 3 Oct 2026

OCC uses an agentic AI SOC agent on Amazon Bedrock to investigate security alerts, gather evidence, and produce auditable results while analysts retain control. #AI #Cybersecurity #SecurityOperations

@TheCyphere on X · 3 Oct 2026

CrowdStrike Delivers the Next Evolution of the Agentic SOC @crowdstrike

@techday_au on X · 3 Oct 2026

Exabeam has added AI tools for triage, reporting and local deployment, aiming to cut security investigation time from hours to minutes. #CyberSecurity #AI #SecurityOps #InfoSec https://t.co/j9huxnGM0j

@cloudgooru.bsky.social on Bluesky · 2 Oct 2026

I've watched $FTNT. Fortinet picks infra-first stack: converged network+security, multitenant AI inference at edge+cloud, agentic SOC telemetry for inference metering.

@mikesaleme on X · 2 Oct 2026

The L2/L4 framing is useful because it separates two different claims: whether the agent can act, and whether a human remains the accountable party when it acts wrong. Most \"autonomous SOC\" pitches answer the first question and go quiet on the second.

@arc-codex.com on Bluesky · 2 Oct 2026

How AI Is Changing the Roles Required in the Security Operations Center This article correctly identifies the shift from alert triage to case ownership, but it underplays the organizational friction inherent in merging these redefined roles across different teams.

@evanderburg on X · 2 Oct 2026

Exabeam Pushes The “Agentic SOC” Into The Cloud And On-Premises, With Analysts Kept In The Loop securitytc.com/TVlVjC https://t.co/GhkJNO0srq

@xyshfox on X · 2 Oct 2026

Finally built my first SOC automation pipeline for my capstone and got it working with a live Kali attack demo, lots of room to grow but proud of where it's at

@MaufacturerOoypk5181 on Reddit · 2 Oct 2026

I am looking at AI SOC and agentic SOC tools because our queue has become a part time lifestyle choice. Every vendor demo has the AI investigate alerts, enrich evidence, and resolve the obvious stuff while humans focus on the exciting task of explaining budget cuts.

@Alarme_Miregeror7362 on Reddit · 2 Oct 2026

We are past the pilot stage now and need investigation logic that matches how our team actually triages, not just the vendor defaults.

@PRTIMES_TECH on X · 2 Oct 2026

Exaforce and Itochu Techno-Solutions to use AI agent-based managed security services for Japanese companies... https://t.co/jYmKQQAed4

@cl0qsearch.bsky.social on Bluesky · 1 Oct 2026

Agentic SOC analysts are the real AI security story — not chatbots writing reports, but agents that actually triage and contain. The force-multiplier framing is right, but the hard part is trust: an agent with containment powers needs guardrails tighter than any human analyst's.

@cl0qsearch.bsky.social on Bluesky · 1 Oct 2026

The paradox of SOC automation — the more AI clears the queue, the fewer reps juniors get on the weird cases that actually teach. Teams need to deliberately feed analysts the hard alerts.

@TheCyberSecHub on X · 1 Oct 2026

Exabeam brings AI-assisted security investigations to data that must stay on-premises www.helpnetsecurity.com/2026/10/01/exabeam-agentic-soc/ https://t.co/pok0SePu7z

@cognna on X · 1 Oct 2026

Your Microsoft security stack can detect a lot. But detection is only one part of security operations. Someone still needs to monitor what matters, investigate suspicious activity, hunt for threats that evade automated detection, and respond when something happens.

@securityopenlab on X · 1 Oct 2026

Agentic SOC: transforming data into defensive speed: Pipeline and AI make SOCs faster and more effective, eliminating manual data work and enabling automated investigation and response. dlvr.it/TVkFVH https://t.co/AE3hqRkXmN

@opanteraos on X · 1 Oct 2026

An investigation agent who matches the analyst's verdict in 95% of cases may still be repeating the alert pattern. Carter Church and Gabriel Bernadett-Shapiro from SentinelOne described this in the text from September 29, 2026: the query used the wrong device identifier, pulled…

@arc-codex.com on Bluesky · 1 Oct 2026

Meet Athena: Huntress' Agentic SOC Analyst This article frames Athena as a force multiplier by emphasizing speed and consistency, yet it downplays the inherent risk that over-reliance on automated verdicts could lead to systemic blind spots if the underlying playbooks are flawed…

@No_Act_5230 on Reddit · 1 Oct 2026

I’m on the security team at a \\~1,000 employee. Fairly small security team, mostly AWS, and we’re using Wiz for cloud security/CDR alongside our SIEM and EDR. Curious how others are handling this because I’m not sure I’m getting the value I expected from CDR.

@BCW_llc on X · 1 Oct 2026

Using AI agents for SecOps shouldn't mean compromising on enterprise governance. Post #2 in our Security Series covers SecOps MCP—standardizing how AI agents interact with Google SecOps using OAuth 2.0, IAM controls, and audit logging.

@CyberTech_In on X · 30 Sep 2026

Agentic SOC governance starts with one question: what is the agent actually authorized to do? Define → Classify → Authorize → Approve → Review. Autonomy without explicit authority is not a control model.

@tbuzzdaily on X · 30 Sep 2026

In a market full of AI powered security tools, one vendor just ranked highest among peers for something less flashy than a chatbot: how well its architecture connects. (@stellarcyberai) Stellar Cyber topped Architectural Alignment in a new 18 vendor AI SOC report.

@stuartjohn3 on X · 30 Sep 2026

UpHold Effect Agentic SOC Automation is a new platform designed by @LeidosInc that uses AI agents to investigate alerts around the clock without taking people out of the loop, a great concept designed to help teams respond faster.

@dheerajitbhu on X · 29 Sep 2026

Where cheap judgment wins: millions of decisions/month, constrained outputs (classify, rank, score, route, approve/reject), recoverable wrong answers, measurable precision/recall. Think alert triage, agent guardrails, queue routing — not essays.

@CivilPrecference-229 on Reddit · 29 Sep 2026

An AI SOC platform is supposed to be software where AI agents autonomously investigate alerts, correlate data across sources, and produce documented conclusions, which sounds architecturally different from a SIEM that added an AI summarization or suggestion feature on top of the…

@vornamemitd on X · 29 Sep 2026

\"Prompt injection via fake/tweaked EDR alerts as a service\" coming to a scene forum near you this fall. Especially tricky with \"AI SOC\" products sold as black box SaaS. Various papers, PoC, and real-world incidents have been tripping up triage agents for months...

@gastronomy on X · 29 Sep 2026

REFINE: A Resilient Evolution Framework for Intelligent Enterprise Alert Triage in Security Operations Centers: Security Operations Centers (SOCs) process large volumes of alerts daily. Alert triage prioritizes high-risk threats while reducing manual review of benign alerts.

@cybersec on X · 28 Sep 2026

I spent years on the offensive side. If I were coming after you today, I wouldn't start with your network. I'd start with the thing reading your alerts. Think about what an AI SOC analyst actually is.

@druce.ai on Bluesky · 27 Sep 2026

Task-driven AI agents chain attack techniques faster than humans, pushing defenders to automate tier-one security alert triage

@williamincyber.bsky.social on Bluesky · 27 Sep 2026

The SOC analyst role is changing. Knowing how to open an alert and follow a playbook is not enough. The path I’m building toward is deeper: SOC fundamentals Investigation Detection engineering Automation AI assisted SOC Agentic SOC

@Potential-Couple-745 on Reddit · 27 Sep 2026

I’ve been working on a small SOC automation project and wanted to share the full flow. The idea was pretty simple: instead of having Wazuh detect an alert and dump raw logs on the analyst, I wanted to automate some of the initial triage.

@0xal0ke on X · 27 Sep 2026

5 repos that turn \"I use AI\" into shippable SOC muscle 1. beenuar/AiSOC — 2.4k★ · self-host AI SOC, MCP for Claude/Cursor, MITRE ledger, no API keys 2. casdoor/casdoor — 14.5k★ · agent-first IAM + MCP gateway so tools stop sharing god-mode tokens 3.

@audnlegacy on X · 26 Sep 2026

We saw too many agentic SOC demos that just rebranded alert noise as insight. Nuclei finds the bugs, but AI needs to verify them or you get hallucinated reports. https://t.co/uDYWZWpUX2

@vornamemitd on X · 26 Sep 2026

Spot on. And also within our domain we need to realize that the age of regexp based detections in legacy SIEMs has finally and abruptly come to an end. I'm looking at you, AI SOC vendors: would you have alerted on the DNS search exfil or screenshot service trickery (in HF hack)?

@vornamemitd on X · 26 Sep 2026

Nobody is going to share the full logs/datasets, but this is exactly what an \"AI SOC\" vendor worth their salt should be able to detect. Increasing clusters of seemingly random URL access -> investigate the what/how (not simple counting) -> raise alert.

@Tesla_Optimus_K on X · 26 Sep 2026

AI hackers are running, but can you stop them with your hands? In a security operations center where thousands to tens of thousands of alerts are triggered every day, while a person opens a single log, attackers are automating everything from vulnerability exploration to…

@communityaws.bsky.social on Bluesky · 25 Sep 2026

"Jev as an alert triage: typed decisions for OpenSearch on-call with Bedrock and AgentCore" by Kumar, Gyanesh #agents #ai-agents #ai-ml #amazon-bedrock-agentcore #amazon-bedrock

@ryanfalk on X · 25 Sep 2026

With Splunk AI Assistant 2.0, Asurion has built the foundation for an agentic SOC, saving hours of manual work and boosting AI trust with custom, context-driven guardrails: https://t.co/IdljcQLqQY https://t.co/xeah6sDTe7

@techfinitive.com on Bluesky · 25 Sep 2026

Zscaler’s new Agentic SOC promises to investigate and automate threat containment at machine speed. ⚡ While zero-trust scale enables rapid automated response, one key question remains: what happens when an automated decision gets it wrong? #Cybersecurity #AI #SOC

@yayafa.bsky.social on Bluesky · 25 Sep 2026

Splunk is promoting "Democratization of Agentic SOC" – Automating security operations with standard functions – ZDNET Japan https://www.yayafa.com/2895074/ Cisco Systems subsidiary S...

@XiaoLuoTian_TOP on X · 25 Sep 2026

yeah “AI SOC” without a real security eng core is a red flag — agents amplify whatever the team already misunderstands about detection

@arc-codex.com on Bluesky · 25 Sep 2026

Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time This article strongly emphasizes the value of a collaborative proving ground, but it downplays the inherent tension in merging operational necessities with innovation testing.

@anton_chuvakin on X · 25 Sep 2026

💯 this. and quite a few “AI SOC” products are built by folks who’ve never spent a day on a detection & response team. > It turns out that when you don't have the ability to evaluate investigative actions effectively, you can't build products or train LLMs effectively for that

@EthicalAI_SF on X · 24 Sep 2026

The 'AI SOC analyst' point hits home. Summarizing logs is trivial. Knowing what an analyst asks next and where telemetry misleads you only comes from running real investigations. The craft still matters.

@gdlinux on X · 24 Sep 2026

AI can improve security productivity without reducing security headcount. Those are not contradictory outcomes. Dark Reading cites survey data showing 91% of CISOs expect AI to make teams more productive, while 81% expect it to create demand for new cybersecurity roles and…

@PCS_AnthonyM on X · 24 Sep 2026

Nice move. Putting XDR and SIEM together in one agentic SOC is the kind of consolidation defenders actually feel day to day.

@Willingt_Atronaut744 on Reddit · 24 Sep 2026

Everyone claims a big noise reduction number in the sales deck. Almost nobody shows the actual before and after methodology, and I've started discounting any number that isn't accompanied by a clear explanation of what was measured and how.

@CIOInfluence on X · 24 Sep 2026

KDDI and Exaforce Bring Agentic SOC Capabilities to Customers Across the United States and EMEA https://t.co/PnNWl3Nkiu #TechnologyNews #AI #TechNews #CIOCommunity #CIOLeadership #CIOInfluence #TechLeadership #ITStrategy #FutureOfIT #TechTrends

@CoreSpacesuae on X · 24 Sep 2026

An agentic SOC only works if people and agents share the same signals, context, and controls — not a separate \"AI layer\" bolted onto a fragmented stack. Speed without a single operating model is just faster handoffs. Judgment stays human. The stack has to be one system.

@camarmir on X · 24 Sep 2026

It’s just repackaging of Sentinel >> Defender XDR >> Agents — Unless enterprises are able to successfully deploy & configure Agentic SOC, the investment is actually counter productive as this will eat SCUs like a cookie monster with unstructured, unhygienic alerts & telemetry.

@montanez_marc on X · 24 Sep 2026

Microsoft just put ISOC inside Defender — agentic SOC, preview today. XDR + SIEM on one platform. Investigate and respond without bouncing tools. Project Perception stays background. The lead is ISOC live in Defender.

@anton_chuvakin on X · 24 Sep 2026

I used to laugh at \"we want to hunt, and no, we don't log yet\" and now we have \"we want to AI SOC, and no, we never heard of SIEM and we have firewall logs only\"

@anton_chuvakin on X · 24 Sep 2026

nothing gets me fired up in the afternoon like discussing the usage of AI in a SOC before a SOC even has the key foundational elements in place to be successful w AI

@xbhaveshverma on X · 23 Sep 2026

The AI SOC Talent Paradox: Automation Is Eating the Entry Level Pipeline. AI is eliminating Tier 1 triage and log analysis roles, with entry level job postings contracting sharply. The paradox?

@Tech_Tonio on X · 23 Sep 2026

SOC Automation Lab Part 4: The SOC lab created its first real case end to end; Alert → enrichment → incident And i built two paths in the automation ; for file hash checking in virustotal and behavioural checking🧵 https://t.co/dZVYsXkFOl

@SagarXploit on X · 23 Sep 2026

6/- Worth a look if you're building detection/SOC automation and full LLM calls are too slow or costly for high volume decisions. https://t.co/BfcfKOZAXw

@SagarXploit on X · 23 Sep 2026

5/ In cybersecurity!?? Guardrails for agentic SOC tools Before an AI agent isolates a host, blocks an IP, or revokes a token, have Jev typecheck it: \"within policy?\" A fast approval gate without a full LLM call per action.

@SagarXploit on X · 23 Sep 2026

3/ In cybersecurity ?? Alert triage Feed Jev an alert + context, ask a Boolean: \"is this a true positive?\" or a Score: \"urgency 1-5?\" Cheap enough to run on every alert instead of sampling, so nothing quietly falls through the queue.

Most shared posts

@nakajimeeee on X · 55 reactions

[SOC use/in-house decision on AI use] "AI SOC can be built in-house" is simplistic, and once built, the obligations of a "security vendor" are incurred according to SentinelOne's warning. In August…

@Kostastsale on X · 46 reactions

Some thoughts about building and learning in our our AI era: AI has made building things ridiculously easy. You can build a website in minutes, connect a few APIs, add an AI layer, and have a product…

@MaxRogers5 on X · 28 reactions

Social

Most shared posts

Get in touch