How AI Agents Could Change SOC Work and Analyst Training
Summary
Sekoia’s David Bizeul discusses how AI agents could handle repetitive SOC triage and investigation, while analysts focus on judgment, agent oversight, training, and metrics such as MTTD, MTTI, and MTTR.
Key points
- Bizeul describes Gartner’s ISOC category as integrating SIEM capabilities with CTI, SOAR, and AI agents in one platform.
- AI agents could take on repetitive triage and investigation, leaving analysts more time for complex decisions and detection engineering.
- Analysts should review agent reasoning, adapt runbooks and queries to their organization, and provide feedback when agents make mistakes.
- Runbooks tied to detection rules could help junior analysts learn threat rationale and investigation methods by reviewing agent work.
- The discussion highlights MTTD, MTTI, and MTTR as SOC performance measures, alongside triage workload and total cost of ownership.
- Bizeul says Sekoia has a triage score of around 94%; he suggests scores above 90% could reduce manual triage work substantially.
Article Details
- Topic
- How AI agents and Gartner’s Integrated Security Operations Center (ISOC) model may change SOC analyst work, training, and performance measurement.