Sekoia Executive Says AI-Powered SOCs Need Context and Human Oversight

Summary

Sekoia’s Cyril Simonnet discusses how connected data, adaptable runbooks, and human judgment can make AI more useful in security operations, and urges teams to test AI claims with controlled attacks and clear evidence.

Key points

Simonnet says AI-supported detection and investigation depend on complete, connected data that gives systems the context they need.
He describes AI as a way to handle repetitive SOC tasks and high volumes of activity, while analysts retain judgment and control over decisions.
Runbooks can make AI actions visible and repeatable, while allowing teams to adapt response steps to their organization.
He recommends evaluating AI security claims through customer evidence, usable and understandable outputs, and controlled attack testing.
The interview warns that incomplete context can lead to hallucinations, incorrect results, and extra work checking outputs.
Simonnet says experienced security professionals remain important for assessing AI results, shaping response processes, and training newer analysts.

Article Details

Topic: How AI is changing cybersecurity operations, with emphasis on data context, human oversight, runbooks, and the economics of security operations centers.