Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver – CYBERDEFENSA.MX
admin Noticias, Trending
Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver – CYBERDEFENSA.MX

Eighteen months ago, the AI SOC was a marketing line. Today it’s a budget item. The category has crossed over from interesting to inevitable, with billions of dollars now flowing into AI-powered security operations platforms, agentic SOC tools, and AI co-pilots built into every layer of the security stack. The data shows SOCs are buying, deploying, and standing up AI capabilities at the fastest pace the industry has ever seen.

And yet, the same SOCs reporting record AI adoption are reporting underwhelming outcomes. The first objective benchmark on the value of AI in the SOC was published in the SOC-CMM 2026 Maturity Report in May, drawing on survey data collected from roughly 200 SOCs across regions, sectors, and delivery models between late January and mid-March 2026. Only about 10% of respondents said AI has delivered excellent value to their SOC. About 19% reported good value. The remaining 71% landed at some value or none at all.

Eighteen months into AI deployment, that’s a structural signal. What follows is a read on what the data confirms, and on what the next wave of AI in security operations must deliver if the industry is going to close the gap.

What the SOC-CMM 2026 data shows

Three findings stand out in the SOC-CMM report’s AI section, and they correlate cleanly with each other once they are read together.

First, adoption is up across every category of AI used inside the SOC. Off-the-shelf large language models grew 55% year over year. AI co-pilots grew 145%. AI agents grew 118%. Supervised machine learning grew 96%. Customized LLMs grew 64%. SOC teams are over-investing in AI without the operational maturity to extract value from what they bought.

Second, the dominant adoption pattern is what the report calls the taker model: off-the-shelf AI deployed inside an existing security stack without customization. About 65% of SOCs surveyed describe themselves as takers. Another 20% are shapers, customizing what they buy. Only 15% are builders, training models against their own data. The takers are the largest cohort and the cohort reporting the least value. Across hybrid SOCs, in-house SOCs, and MSSP SOCs, the perceived value distribution is nearly identical. That uniformity is the tell. The pattern cuts across delivery model, region, and sector. The cause is structural.

Third, the report flags that the two SOC improvement challenges that grew year over year are lack of best practices (+17%) and complexity of increasing maturity (+11%). Every other challenge category, including lack of budget and lack of management support, dropped. SOCs aren’t telling the survey they don’t have money or executive support. They’re telling the survey they don’t know what they’re supposed to be doing with the AI they bought. That is the AI maturity gap in one data point.

Why the first wave of AI in the SOC underperformed

The first wave of AI SOC tools shipped as features bolted onto existing security products. SIEMs got AI triage. EDRs got AI investigation. SOAR platforms got AI playbook generation. Ticketing tools got AI summarization. Each feature was real. Each one worked in isolation. None of them shared context with the next.

What that means in practice is that SOC analysts now have five AI assistants instead of one. The triage agent in the SIEM does not know what the detection engineer silenced last week. The threat hunting agent in the EDR does not know what the threat intel team flagged that morning. The summarization agent in the ticketing tool does not know what the investigation surfaced two hops ago. Each agent accelerates its own slice of the workflow. None of them fixes the handoffs between slices, which is where most SOC time and most SOC value live.

SOC operators describe this pattern in conversations across the industry. They describe faster individual tasks and the same fragmented workflow. They describe being asked to learn five new agent interfaces while the core problem, which is that the SOC operates as a chain of disconnected stages, didn’t move at all. The AI accelerated each silo without connecting them.

The SOC-CMM 2026 report puts numbers on this dynamic too. The technology domain is again the highest-scoring maturity domain across the dataset, at an average of 2.7 out of 5. The process domain, where the handoffs between SOC stages live, scores 2.3. The people domain, where the institutional knowledge and decision-making capacity live, scores 2.3 as well. Buying more tools, including AI ones, does not move those numbers. In some SOCs it makes them worse, because each new tool adds a handoff.

What’s different about the SOCs that report excellent value

The 10% of SOCs reporting excellent value from AI are not running different point tools. They’re running AI inside a different architectural structure. Three things separate them from the 71%.

  1. AI that operates across the SOC lifecycle, not inside one stage of it. Threat intelligence, threat hunting, detection, investigation, and remediation are five stages of one workflow. When agents operate across all five stages and feed each other context, the SOC compounds. Every closed investigation calibrates the next detection. Every threat hunt result updates the next intel cycle. Every remediation feeds back into the playbook the next agent uses. The connected fabric is what produces sustained value. The SOCs reporting excellent value tend to have AI architectures that look like fabric. The SOCs reporting good value tend to have stacks of features.
  2. AI that knows the dynamic environment it’s operating in and continuously draws on it. Generic AI produces generic investigations. «Normal» looks different in a healthcare environment than a fintech one. A detection rule that fires on a real threat in one environment will fire on routine activity in another. An investigation that escalates correctly in one environment will overlook the right answer in another. SOCs reporting value have AI systems that capture and persist institutional knowledge: the assets that matter, the analysts whose judgment shaped past incidents, the sanctioned actions, the escalation criteria, the tickets that turned out to be nothing and the ones that turned out to be everything. Without that grounding, AI in the SOC produces the average of the internet, which is the wrong answer in most environments.
  3. AI that is governable. The SOC-CMM 2026 report identifies effective SOC governance as the single most challenging area of SOC improvement, with 39% of respondents naming it. AI governance and SOC governance overlap. The agentic SOC operates inside customer-defined guardrails. It exposes a defensible reasoning trace for every action. It earns autonomy in stages rather than asking for it upfront. AI in the SOC cannot be a black box. The SOCs that figured this out are the SOCs where analysts trust the system enough to give it standing authority. That trust is what produces the productivity gain. Without it, the system stalls.

The architecture problem, in plain terms

Most enterprises trying to extract value from AI in the SOC today are running point AI inside a fragmented architecture. The point AI works inside a broken architecture. That is the architecture problem.

If a SOC’s detection engineering team works in a different tool than its investigation team, AI in either tool will accelerate that team’s slice of the workflow and do nothing about the handoff between them. If a SOC’s threat hunters cannot easily test hypotheses across the same telemetry its investigations use, AI in either workflow will move only that workflow forward. If a SOC’s remediation playbooks live in a SOAR tool that does not see what its investigation agent concluded, AI remediation will execute against stale context.

The fix is connecting the stages. More AI inside the same fragmented architecture compounds the original problem. That connective fabric is what «second wave» means. The first wave delivered AI per stage. The second wave delivers AI across stages.

What the second wave must look like

The five stages of the SOC must operate as one agentic fabric grounded in the customer’s environment. Every closed investigation calibrates the next detection. Every threat hunt result updates the next intel cycle. Every remediation feeds back into the playbook the next agent uses. The SOC compounds.

In practice, a platform built this way sits on top of the SIEM, EDR, identity, cloud, ticketing, and threat intel stack an organization already owns rather than replacing it. The connective layer is what lets each stage feed the next instead of operating in isolation. Where that architecture is in place, SOCs report sharper investigations completed faster, detections that get surfaced and tuned instead of left silent or noisy, threat hunts that run continuously rather than episodically, and remediation that operates inside defined guardrails with full reasoning traces and audit-grade decision records.

The second wave of AI in the SOC must look architectural, not featural. The vendors and platforms that figure that out are the ones whose customers will move from «some value» to «excellent value» in next year’s benchmark.

Spotlight: End-to-End Agentic AI for Security Operations

One platform built around this architecture is Conifers’ end-to-end agentic SOC, launched in May 2026 on its CognitiveSOC™ platform. Rather than adding AI to a single stage, it connects threat intelligence, threat hunting, detection engineering, investigation, and remediation into one operating fabric grounded in each customer’s institutional knowledge. The five functions feed each other context, so hunts inform detection, investigations calibrate future detections, and remediation runs inside customer-defined guardrails instead of static playbooks.

Governance is built in from the start. Every agent action carries a reasoning chain and an evidence trail, and customers set the scope and authority each agent operates under, expanding autonomy as confidence builds. That is the move from human-in-the-loop to human-on-the-loop oversight. The system runs on top of the stack a SOC already owns, with more than 60 integrations across EDR, identity, cloud, email, and ITSM, and no rip-and-replace migration.

The window is closing faster than most SOCs think

Adversaries are not waiting for the second wave to arrive. Google’s Threat Intelligence Group disclosed the first confirmed AI-developed zero-day exploit earlier this year. Anthropic’s Claude Mythos preview is identifying critical vulnerabilities at machine speed. JPMorgan’s CISO published an open letter in April 2025 warning that the economics of cyber risk are shifting and that security buyers need to demand secure-by-default products instead of the current pace of rushed feature releases.

The defenders running first-wave AI inside a fragmented SOC will be the ones explaining what happened the morning after a breach. The defenders running second-wave AI as a connected fabric, with institutional knowledge inside the loop and governance built in from the start, will be the ones who saw it coming. The 10% number in the SOC-CMM 2026 report is a signal about the architecture most SOCs run right now. It is also a signal about which side of the next breach narrative each SOC will be standing on.

Visit Conifers.ai to request a demo and experience the power of a full lifecycle agentic SOC.

Frequently Asked Questions

Why are most SOCs reporting limited value from AI in 2026?

The SOC-CMM 2026 Maturity Report found that about 71% of SOCs see only some value or no value from their AI deployments. The root cause is architectural rather than technological. Most SOCs deployed AI as features inside individual products such as SIEMs, EDRs, and ticketing systems. Each feature accelerated its own stage of the workflow. None of them shared context across stages. The handoffs between threat intel, detection engineering, investigation, and remediation, which is where most SOC time goes, did not improve. AI accelerated the silos without connecting them. That is what produces «some value» instead of excellent value.

What does «second wave AI» in the SOC mean?

Second wave AI in the SOC means agentic AI that operates across the full SOC lifecycle rather than inside a single stage. The five stages of the SOC, threat intelligence, threat hunting, detection engineering, investigation, and remediation, run as one connected fabric. Agents share context. Closed investigations calibrate future detections. Threat hunt results update threat intel cycles. Remediation actions feed back into the playbook the next agent uses. The SOC compounds. This is the architectural pattern shared by the roughly 10% of SOCs reporting excellent value from AI in the SOC-CMM 2026 data.

Is the problem that SOCs are not buying enough AI?

No. The SOC-CMM 2026 data shows AI adoption growing aggressively across every category, with off-the-shelf LLMs up 55%, AI co-pilots up 145%, and AI agents up 118% year over year. SOCs are buying. The problem is that adoption is outpacing operational maturity. Two-thirds of SOCs are deploying off-the-shelf AI inside an existing security stack without modifying anything else around it. That cohort reports the least value. Buying more AI without changing the architecture it operates inside compounds the original problem instead of solving it.

How does institutional knowledge change AI SOC outcomes?

Generic AI produces generic investigations. A detection rule that fires on real threats in one environment will fire on routine activity in another. An investigation that escalates correctly in one organization will miss the right answer in another. AI systems that continuously ingest and persist dynamic institutional knowledge, the assets that matter, the analysts whose judgment shaped past incidents, the sanctioned actions, the escalation criteria, the historical incident outcomes, produce investigation results that match how a specific SOC operates. AI without that grounding produces the average of the internet, which is the wrong answer in most environments. Institutional knowledge is the difference between AI that produces noise and AI that produces decisions.

What should CISOs ask before buying their next AI SOC tool?

Three questions matter most. Does this AI operate across the full SOC lifecycle, or only inside one stage of it? How does the AI learn and persist the institutional knowledge of the organization’s specific environment, and what happens to that knowledge when analysts leave? Can the team audit every agent action with a defensible reasoning trace, and can it govern agent autonomy in stages as trust builds? A vendor that cannot give clear answers to all three is selling first-wave AI, no matter what the marketing says.

What is the agentic SOC, and how is it different from a SOAR or AI co-pilot?

The agentic SOC is the category of security operations platform where AI agents operate as decision-makers across the SOC lifecycle, not as assistants inside a single product. A SOAR automates predefined workflows using static playbooks. An AI co-pilot accelerates an analyst’s individual tasks. An agentic SOC runs agents that reason through investigations, surface and tune detections, threat hunt continuously, and remediate inside customer-defined guardrails, all while sharing context across stages. Analysts move from «in the loop» on every step to «on the loop» overseeing the system.

How quickly can a SOC move from first-wave AI to second-wave AI?

Faster than most teams assume. The shift is architectural, not a rip-and-replace. The connective layer that turns point AI into agentic fabric does not require buying new tools or replacing existing ones. It requires connecting what the SOC already owns into a system that compounds. Most SOCs underestimate how quickly the shift can be made once the architecture is in place.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Attackers Don’t Just Send Phishing Emails. They Weaponize Your SOC’s Workload – CYBERDEFENSA.MX
admin Noticias, Trending
Attackers Don’t Just Send Phishing Emails. They Weaponize Your SOC’s Workload – CYBERDEFENSA.MX

The most dangerous phishing campaigns aren’t just designed to fool employees. Many are designed to exhaust the analysts investigating them. When a phishing investigation takes 12 hours instead of five minutes, the outcome can shift from a contained incident to a breach.

For years, the cybersecurity industry has focused on the front door of phishing defense: employee training, email gateways that filter known threats, and reporting programs that encourage users to flag suspicious messages. Far less attention has been paid to what happens after a report is filed, and how attackers exploit the investigation process that follows. 

Alert fatigue in Security Operations Centers isn’t just an operational inconvenience. It can become an attack surface. SOC teams increasingly report phishing campaigns that appear designed not only to compromise targets but also to overwhelm the analysts responsible for investigating them. 

This shifts how organizations should think about phishing defense. The vulnerability isn’t just the employee who clicks. It’s also the analyst who can’t keep up with the queue. When investigations that should close in minutes stretch to 3, 6, or 12 hours because of queue congestion, the window for attacker success widens dramatically.

When Phishing Volume Becomes a Weapon

Phishing is often treated as a series of independent threats. One message. One potential victim. One investigation. Attackers operating at scale think in terms of systems, not individual messages. A SOC is one of those systems, and it has finite capacity and predictable failure modes.

Consider a phishing campaign targeting a large enterprise. The attacker sends thousands of messages. Most are low-sophistication lures that email gateways or trained employees will likely catch. These messages flood the SOC with reports and alerts. Analysts begin triaging, working through a queue that grows faster than they can clear it.

Buried in that volume are a few carefully crafted spear-phishing messages targeting individuals with access to critical systems. These messages are the real payload. The flood is not just a numbers game. It is effectively a denial-of-service attack against the SOC’s attention, sometimes referred to as an Informational Denial-of-Service (IDoS).

This pattern is not purely theoretical. Red team exercises and incident reports have documented adversaries who time high-volume phishing campaigns to coincide with targeted spear-phishing attempts. The commodity wave creates noise. The targeted message hides inside it. 

The Predictable Failure Mode

This tactic works because SOC phishing triage tends to follow a predictable pattern across organizations. When phishing report volume spikes, most SOCs respond in predictable ways. Analysts begin triaging faster, spending less time per submission. Investigation depth decreases. Industry research shows 66% of SOC teams cannot keep up with incoming alerts. The focus shifts from thorough investigation to clearing the queue. Managers may deprioritize phishing reports relative to alerts from other detection systems, assuming user-submitted reports are lower fidelity.

Each response is rational on its own. Together, they create the conditions an attacker needs.

SOC managers observe a consistent pattern during high-volume periods: decision quality drops as workload increases. Analysts begin anchoring on superficial indicators. Messages that «look like» previously benign submissions receive less scrutiny. Novel indicators of compromise may be overlooked when they appear in a crowded queue rather than in isolation.

The attacker’s advantage compounds because the most dangerous messages are specifically designed to exploit these shortcuts. A spear-phishing email targeting the CFO’s executive assistant doesn’t arrive looking dramatically different from everything else in the queue. It’s crafted to resemble the category of messages that analysts, under pressure, have learned to move past quickly — a vendor communication, a document-sharing notification, a routine business process email.

The Economics Behind the Attack

The economics of this dynamic heavily favor the attacker. Generating thousands of commodity phishing emails costs almost nothing, especially with generative AI lowering the production barrier further. But each of those emails, once reported by an employee, costs the defending organization real analyst time and cognitive bandwidth.

This creates an asymmetry that traditional SOC models have no good answer for:

  • Attacker cost per decoy email: near zero. Template-based generation, commodity infrastructure, automated delivery.
  • Defender cost per reported email: minutes of skilled analyst time for even a cursory review. Hours if the investigation is thorough.
  • Attacker cost for the real payload: moderate — these are the carefully researched, individually crafted messages designed for specific targets.
  • Defender cost of missing the payload: potentially catastrophic — credential compromise, lateral movement, data exfiltration, ransomware deployment.

The defender is forced to investigate everything because the cost of missing a real threat is so high. The attacker knows this and uses it to drain investigative resources before the real attack arrives. It’s an attrition strategy applied to human attention rather than system availability.

This asymmetry has only worsened as organizations have scaled up phishing awareness programs. More trained employees means more reports. More reports means more queue pressure. More queue pressure means less attention per investigation. The very success of security awareness training has, paradoxically, expanded the attack surface that adversaries exploit.

The Real Problem is Decision Speed

Most security tools respond to this challenge by throwing more alerts at people — additional detection layers, more threat feeds, extra scoring systems. More data without better decision processes only compounds the overload. The fundamental issue isn’t that SOCs lack information about suspicious emails. It’s that they lack the ability to turn that information into clear, confident decisions at the speed the threat environment demands.

The organizations breaking out of this cycle are reframing phishing triage not as an email analysis problem but as a “decision precision” problem. The goal isn’t to generate more signals about a suspicious message. It’s to deliver a decision-ready investigation — a complete, reasoned verdict that tells the analyst exactly what was found, what it means, and what should happen next — so that no one has to guess.

This distinction matters because guessing is exactly what overwhelmed analysts are forced to do. When the queue is deep and investigation time is compressed, analysts make judgment calls based on incomplete analysis. Sometimes they’re right. Sometimes they’re not. And the attacker’s entire strategy depends on those moments when they’re not.

Decision-ready investigation changes the equation. Instead of presenting analysts with raw indicators and expecting them to assemble a conclusion under time pressure, the system delivers a synthesized assessment with clear reasoning. The analyst’s role shifts from doing the investigation to reviewing the investigation — a fundamentally different cognitive task that scales far more effectively under volume.

Why Rule-Based Automation Doesn’t Solve This

The obvious response is automation, and most SOCs have implemented some version of it. Auto-closing reports from whitelisted senders. Deduplicating identical submissions. Applying basic reputation checks to filter known-safe domains.

These measures help with baseline volume but fail against the specific threat model described above — and in some cases, they make it worse.

Rule-based filters create predictable blind spots. If an attacker knows (or can infer) that an organization auto-closes reports from domains with established reputation, they can compromise or spoof those domains. If deduplication logic groups messages by subject line or sender, an attacker can vary these superficially while maintaining the same malicious payload.

There’s also the trust problem. Security teams are rightfully skeptical of «black box» automation that renders verdicts without showing its work. When an automated system closes a phishing report, and no one can explain exactly why, confidence erodes. Analysts second-guess the automation, re-investigate cases it already handled, or override its decisions reflexively. The efficiency gains evaporate, and the organization ends up with the worst of both worlds: automation it’s paying for and manual processes it can’t abandon.

More fundamentally, static rules can’t adapt to the dynamic relationship between attack patterns and SOC behavior. The attacker’s strategy isn’t static. It continuously evolves based on what works. A defensive system built on fixed rules is playing a static game against a dynamic adversary.

Specialized Investigation Agents, Not Black Boxes

The emerging approach to adversarial phishing defense looks less like a single automated tool and more like a coordinated team of specialized experts — each focused on a specific dimension of the investigation and each capable of explaining exactly what it found and why it matters.

In practice, this means agentic AI architectures where distinct analytical agents handle different parts of a phishing investigation simultaneously. One agent verifies sender authenticity — checking SPF, DKIM, and DMARC records, analyzing domain registration history, and evaluating whether the sending infrastructure matches the claimed identity. Another examines the message itself, analyzing linguistic patterns, tone inconsistencies, and social engineering indicators that suggest manipulation rather than legitimate communication. A third correlates the report with endpoint telemetry, determining whether the recipient’s device has exhibited any behavioral anomalies that might indicate a payload has already executed.

These agents don’t operate independently and disappear into a verdict. They produce transparent, auditable reasoning — a clear chain of evidence showing which indicators were evaluated, what was found, and how those findings contributed to the final assessment. When the system determines a message is benign, it shows why. When it flags a message as malicious, it presents the specific evidence. When signals conflict, it explains the ambiguity and escalates with full context.

This transparency is what separates decision-ready investigation from black box automation. An analyst reviewing an AI-generated investigation can see the logic, challenge the reasoning, and build calibrated trust in the system over time. That trust is what ultimately allows organizations to let the system handle routine verdicts autonomously — not blind faith in an opaque algorithm, but earned confidence in a process that shows its work.

The Five-Minute Reality

The practical impact of this approach comes down to time — specifically, the difference between the 3-to-12-hour investigation timelines that characterize most manual SOC phishing workflows and the sub-five-minute resolution that decision-ready AI triage enables.

This gap is not only an efficiency metric. It directly affects security outcomes. In 12 hours, a compromised credential can be used for lateral movement, privilege escalation, and data staging. In five minutes, the same credential gets revoked before the attacker establishes persistence. A “non-event.” The same phishing email produces radically different consequences depending entirely on how fast the investigating organization reaches a confident decision.

When cognitive AI handles initial investigation, every submission gets the same rigorous, multi-dimensional analysis regardless of queue depth or time of day. The commodity phishing flood designed to exhaust analysts gets absorbed by a system that doesn’t fatigue. The carefully crafted spear-phish designed to blend in during high-volume periods receives the same thorough investigation as every other submission, with cross-submission pattern detection that might flag it precisely because of its relationship to the surrounding volume.

The human analysts, the experienced, skilled professionals that every SOC depends on, shift from reactive queue processing to the work that genuinely requires human judgment: investigating confirmed incidents, hunting for threats that haven’t triggered alerts, and making strategic decisions about defensive posture.

Measuring SOC Resilience

Organizations that adopt this framing need metrics that reflect it. Traditional SOC metrics, such as mean time to acknowledge, mean time to close, and tickets processed per analyst, measure operational efficiency. They don’t measure resilience against adversarial exploitation.

Metrics that capture defensive resilience against weaponized volume include:

  • Investigation quality consistency under load. Does analytical depth remain constant as report volume increases, or does it degrade? Tracking investigation thoroughness across volume quartiles reveals whether the SOC’s phishing triage is exploitable under pressure.
  • Decision latency. How quickly does the triage system move from alert receipt to confident verdict? The gap between 12 hours and 5 minutes isn’t an incremental improvement; it’s a categorical change in attacker opportunity.
  • Escalation accuracy at volume. When the queue is heavy, are the right cases being escalated to human analysts? Rising false negative rates during high-volume periods indicate exactly the vulnerability attackers target.
  • Decision transparency rate. What percentage of automated verdicts include complete, auditable reasoning? Black box resolutions that can’t be explained are resolutions that can’t be trusted, and untrusted automation gets overridden, negating its value.
  • Proactiveness. How close to the point of impact are threats being identified?

Changing the Defensive Equation

The attacker’s advantage in weaponizing SOC workload depends on a specific assumption: that increasing phishing volume reliably degrades defensive quality. If that assumption holds, the strategy is highly effective and nearly free to execute. If it doesn’t — if investigative quality and speed remain constant regardless of volume — the entire approach collapses.

The commodity phishing flood no longer provides cover because every message receives the same analytical rigor in the same five-minute window. The carefully crafted spear-phish no longer benefits from a rushed analyst because no analyst is rushing. The asymmetry flips: the attacker spent resources generating noise that achieved nothing, while the defender’s capacity for genuine threat detection remained intact.

The strategic value of decision-ready AI triage is not just efficiency. It removes a failure mode that attackers have learned to exploit. It turns a predictable vulnerability into a defensive strength, making the SOC’s phishing workflow resilient against the very tactic designed to break it.

The phishing report button stays. Employees keep reporting. But the investigation engine behind that button no longer offers attackers a lever to pull.

Conifers.ai’s CognitiveSOC platform uses agentic AI to deliver decision-ready phishing investigations in minutes, not hours. Learn more about how the Conifers platform is designed to reduce the alert-fatigue conditions attackers often exploit.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.