AI in Cybersecurity: Faster SOC Workflows and the Need for Technical Judgment

Summary

The speaker argues that AI will accelerate security operations and attacker workflows. He describes potential AI-assisted SOC triage and phishing, while emphasizing that defenders need strong technical judgment to assess AI-generated results.

Key points

• The speaker says security roles are shifting from manual task execution toward building and coordinating AI agents.
• He describes a possible SOC workflow where AI gathers and queries logs, interprets findings, and drafts reports; he estimates this could reduce work on one finding from nine hours to 15–20 minutes.
• He warns that AI could help attackers draft phishing emails and speed up attack activity, though he presents these as general examples rather than a specific incident.
• He argues defenders should use AI in response, while retaining people who can assess evidence and make technical decisions.
• His main career advice is to build strong fundamentals and understand code, configurations, logs, and system dependencies rather than relying on AI output alone.
• He recounts using AI in penetration testing and reviewing its logged commands to distinguish errors and false positives from a real vulnerability.

MITRE ATT&CK

Industries

Related Articles

• AI Makes Fake Login Pages More Convincing and Account Takeovers Easierthehackernews.comT1566
• CYFIRMA Report Tracks India Healthcare Threat Activity, With Pharma Claims Unconfirmedcyfirma.comT1566
• Recorded Future Reports 48% Rise in Cyberattack Reports Against Japanese Organizationsrecordedfuture.comT1566
• Huntress Details Phishing Kits Targeting Microsoft 365 Tokens and Defender Responseshuntress.comT1566
• PHP Releases Emergency Fixes for PHP2Shell Vulnerabilities Amid Early Attack Reportsmalwarebytes.comT1566