CISO Takeaways on AI SOCs, Security Budgets and SOC Metrics
Summary
Drawing on an Intezer AI SOC event, the author argues that AI is changing SOC operations, security budgets and vendor contracts. The article highlights a proposed executive metric, AVERT, and the importance of mature SOC foundations.
Key points
- The author recounts an unnamed CISO receiving four budget offers after the Mythos announcement, which the article says heightened executive concern about AI-era threats.
- Intezer’s 2026 AI SOC Report is cited as finding that nearly 2% of low-severity endpoint alerts are real threats.
- Event speakers argued AI SOC models could investigate more alerts and reduce reliance on tiered human triage.
- Mitchem Boles proposed AVERT (Action-Verified Resolution Time) as an executive metric focused on verified threat neutralization; its cited figures are presented as aspirational targets, not industry averages.
- Speakers described a shift toward one-year security vendor contracts and said MSSPs and MDRs relying on tiered analysis may need to adapt.
- The author argues mature SOC foundations—including reliable logging, tuned detections and defined runbooks—make AI adoption more effective, while AI may amplify problems in immature SOCs.
Article Details
- Topic
- AI-driven SOC operations, CISO budgeting, and security procurement
People
Alon CohenCyberArk founder and Intezer executive chairman who argued that machine-speed attacks require faster defensive approaches.Deepak KolingivadiServiceNow representative who argued that security practitioner roles are changing toward automation, orchestration, and scale.Doug MayerWCG Clinical CISO who advocated using the Mythos announcement to secure security funding and argued for focusing on containment and replacing tiered SOC analysis.Itai TevetIntezer co-founder and CEO who discussed how AI SOC operations could investigate alerts consistently and reduce human bottlenecks.Jen GreulichLegato Security leader cited as an example of a security services provider adapting beyond tiered analysis.Mitchem BolesIntezer Field CISO who proposed AVERT as an executive metric and presented a framework for communicating security outcomes to boards.Nick VigierOscar Health CISO who argued that SOC delays can stem from concentrated decision ownership and proposed measuring time to decision.Paul CarpenitoION Group CISO who emphasized that mature SOC foundations enable safer and faster AI adoption.Pavi RamamurthyBlackhawk Network CISO who described CISOs shifting from multi-year security contracts to one-year deals.
Vendors
Products
Claude CodeThe November 2025 GTG-1002 disclosure showed nation-state actors running 80 to 90% of an espionage campaign autonomously through Claude Code at thousands of requests per second.Mozilla FirefoxAnthropic’ showed a model that weaponized 181 working attacks from a single Firefox vulnerability set, where the prior generation managed two.MythosThe article highlights how AI is reshaping the CISO role, SOC operations, and security buying decisions, with executives using the Mythos announcement to push for more budget and faster modernization.