AI in the SOC: Where security teams stand

Let’s start with the good news because there's plenty of it. Nearly all surveyed teams (99.8%) report benefiting from AI adoption. The top gains map directly to analyst pain points:

• Faster investigations (61%): The single most common benefit and the one that matters most to anyone working a queue

• Improved overall security posture (53%): Broader coverage, fewer blind spots

• Better detection quality (48%): Fewer missed threats, more signals

• Analyst operational efficiency and time savings (46%): The core promise of AI in the SOC

For a Tier 1 analyst drowning in alerts or a Tier 3 hunter chasing a complex intrusion, faster investigations and sharper detection translate into real relief. The data suggests AI is genuinely helping teams do more with the people they already have.

Despite these near-universal benefits, however, 85% of surveyed teams also report negative impacts from AI adoption. This contradiction of value received, along with negative impacts, shows that value and friction are arriving together.

The survey found that 75% of teams use general chatbots like ChatGPT, Claude, or Copilot, while 66% use native AI features built into their security tools. This elevated level of general chatbot use over native AI features is worth unpacking as it paints a picture of how teams are actually using AI in the SOC.

Why are security professionals reaching for AI outside the security stack? Respondents point to practical reasons:

• General-purpose tools handle a broader range of tasks (58%).

• Cost and token management push teams toward outside options (48%).

• Ease of use draws analysts to familiar assistants (40%).

If an analyst leaves the investigation window to consult a chatbot, pasting context and files as needed, copying the answer back, and then verifying it against the data they just left behind, it’s merely a new take on the old swivel-chair problem. Repeating that disconnected process across the length of their shift and the perceived time savings from one task being automated is actually being reincarnated as time loss for this new game of AI telephone.

This “sidecar AI” use doesn’t just create inefficiencies; it also opens up new risk exposure in the form of sensitive information disclosure, insecure plugin design, or insecure output handling. Aside from the obvious risk of data exposure with sidecar AI, there’s also the more subtle risk of receiving and trusting highly confident yet low fidelity responses. 

After all, a model that has limited context or visibility into the data it's being prompted upon may give the OK , which could be accurate for the dataset it's been asked to analyze. But it doesn’t have the comprehensive security telemetry set to operate from. This can give analysts an inflated sense of security. 

And, of course, this AI tool pivoting burns spend on models that lack the context to help. And with the most cited negative impact from AI adoption being cost (57%), this is a problem that compounds. Paying for models that lack context means paying for confident guesses and then paying again in analyst hours to confirm or undo them.

AI that lives in a separate window doesn't reduce toil; it relocates it. Every context switch is a chance to lose the thread, introduce an error, or paste something sensitive where it shouldn't go. The efficiency promised on paper leaks through the gaps between tools. Security teams don't need more AI tools; they need AI that works where security data already resides.

The alternative is AI that works inside the analyst's existing flow rather than off to the side. When AI is embedded in the investigation itself, there's no copy-paste loop, separate destination, or context lost in transit. The analyst stays on the case while the AI does the correlating, enriching, and surfacing.

This matters most for the rework problem. Embedded AI operates on the same data the analyst is already looking at, which means its reasoning is grounded in real context rather than whatever was pasted into a chat box. Grounded reasoning is easier to verify, and easier verification is the whole game, especially considering 50% of survey respondents say most AI outputs require correction or rework before they can be used.

When AI reasoning is visible inside the tools analysts already use, the team stays close to its own stack instead of outsourcing judgment to an external window. Consider what each should require before trusting an AI-assisted workflow:

• Transparency: Can you see how the AI reached its conclusion, step by step?

• Editability: Can an analyst correct or redirect the reasoning when it's wrong?

• Data proximity: Does the AI work on your data in place, or does it pull context out to somewhere else?

• Human approval: Does a person sign off on consequential actions?

The survey data shows clearly that analysts want more automation, but not unsupervised automation. A striking 89% agree that the future of AI for security operations is automated agentic workflows paired with detailed human oversight and clear governance. Only 18% report they have a fully developed governance framework available to them today.

That gap between ambition and readiness is the real work ahead. Teams aren't asking AI to make the final call; they're asking it to do the legwork and show its reasoning so that a human can make the call faster. The findings suggest the winning formula is agents that investigate, correlate, and propose, while a person approves anything consequential.

For teams building toward this, the sequence matters. Governance and transparency aren't features added on after scaling automation. They're the foundation that makes scaling safe in the first place.

The research points to a maturity effect worth noting: Teams with mature AI adoption report significantly more value than teams still in the pilot stage (100% report moderate or significant value compared to just 60% at the limited-use stage). Maturity correlates with value, which suggests the answer isn't less or limited AI, but better integration and frameworks.

So, when assessing your next AI-enabled security capability, the questions shift. Focus should be on AI tools’ transparency, editability, and ability to work directly off a unified data foundation to provide the most contextually rich responses for analysts. 

This is the design philosophy behind Elastic Security — the open, agentic security platform where a model-agnostic agentic workflow investigates and proposes actions across the alert lifecycle, and analysts approve as much (or as little) as they need to ensure accurate and timely response.

Curious where your team's AI maturity and oversight stand against industry benchmarks? Access the full AI Adoption in the SOC report to see how your SOC compares.

Ready to see what embedded, transparent AI looks like in practice? Explore Elastic Security's open, agentic security operations platform.