How does a SOC use AI — and what do human Tier-3 analysts still do?
Security operations centres use AI and automation mainly to sort, correlate and enrich alerts and to draft incident summaries, so analysts see fewer, better-prioritised cases; people still make the decisions — investigating, deciding whether to contain, and talking to the customer. At Cyber NCS, 24/7 monitoring and response are delivered by the group's central SOC & MDR hub (Tier-3), DIAMATIX.
Last updated:
What does AI do in a SOC today?
AI-assisted analysis can help organise security signals into cases that are easier to review. Automation can collect context, connect related activity and prepare a draft incident summary. These are general uses of AI and automation in security operations, not a description of particular tools or workflows used by DIAMATIX.
The distinction is between assisting analysis and making a decision. A suggested priority, explanation or response option still needs to be checked against the evidence, the affected environment and the customer's agreed response process.
| SOC task | What automation / AI typically does | What human analysts do |
|---|---|---|
| Alert triage | Sort alerts, identify duplicates and suggest priorities based on available signals. | Review priority, validate suspicious activity and decide what needs investigation. |
| Correlation across endpoint/email/identity | Connect related signals across systems and suggest a possible incident timeline. | Check whether the signals belong to the same incident and interpret their business context. |
| Enrichment | Gather supporting information about indicators, affected assets and previous activity. | Check the relevance, reliability and completeness of that information. |
| Threat hunting | Help search activity, highlight patterns and suggest hypotheses for investigation. | Form and test hypotheses, examine evidence and decide whether a threat is present. |
| Containment decision | Suggest response options or support predefined, approved workflows. | Decide whether containment is appropriate, consider business impact and approve action according to the agreed process. |
| Root-cause and lessons learned | Organise evidence and draft a timeline or summary for review. | Determine the cause, validate conclusions and recommend changes based on the evidence. |
| Customer communication | Draft incident updates from the available case information. | Confirm accuracy, explain uncertainty and discuss decisions with the customer. |
| Reporting | Assemble case details and draft incident summaries. | Review and approve the report, ensuring it accurately reflects the evidence and decisions. |
What are the limits of AI in threat detection?
AI can raise false positives, treating benign activity as suspicious, and false negatives, missing activity that needs investigation. Missing or incomplete signals can also lead to a misleading explanation. A fluent incident summary is not proof that its conclusions are correct.
Business context matters: an unusual login, a maintenance task or a system change may need an explanation from the customer. Human review connects the technical evidence to that context. Accountability remains with the people and organisations responsible for the service, including the review and approval of response decisions.
Why do Tier-3 analysts still matter for small businesses?
Small businesses need decisions that consider how they operate, not just whether an alert looks unusual. Isolating an endpoint or restricting access can interrupt work. Analysts need to weigh the evidence, uncertainty and potential business impact before deciding on the next step.
Tier-3 analysts bring judgement to complex investigations: testing explanations, connecting evidence and deciding what needs further examination. They also help explain findings and response options to the customer. AI assistance does not replace that responsibility.
What should you ask a SOC provider about its use of AI?
- Who approves containment, and how are actions with business impact agreed with the customer?
- How is AI output reviewed before it is used in an investigation or response?
- What data is sent to AI services, and how is access to that data controlled?
- How are decisions, approvals and the evidence behind them logged?
Ask for a clear explanation of the review and approval process rather than relying on an AI label. The answers should distinguish automated assistance, authorised actions and the decisions that require human review.
How does Cyber NCS deliver 24/7 SOC & MDR?
At Cyber NCS, 24/7 monitoring and response are delivered by the group's central SOC & MDR hub (Tier-3), DIAMATIX. This guide does not claim which AI tools DIAMATIX uses or how much of its work is automated.
CyberOM is the MSSP brand for SMEs in Israel and Australia, with managed cybersecurity services, licences and subscriptions available through the CyberOM online store. OMNI-SOC is the SOC platform for MSP partners.
For group enquiries, contact office@cyberncs.com.
What are the frequently asked questions about AI in a SOC?
- What does AI typically do in a SOC?
- AI and automation typically help sort, correlate and enrich alerts and draft incident summaries. Human analysts review the output, investigate the evidence and make response decisions.
- Can AI replace human Tier-3 analysts?
- AI can assist analysis, but it does not remove the need for human judgement, business context or accountability. Tier-3 analysts investigate complex cases, assess uncertainty and consider the business impact of response decisions.
- What are the limits of AI in threat detection?
- AI can produce false positives and false negatives, and its output may miss business context or rely on incomplete information. Analysts must review the evidence rather than treat an AI-generated conclusion as a confirmed finding.
- Who should approve containment?
- A SOC provider should explain who is authorised to approve containment and how that authority is agreed with the customer. Actions that affect business operations need an approval process, including any predefined response workflows.
- What should a business ask about data sent to AI services?
- Ask what incident or customer data is sent to AI services, how access is controlled, how outputs are reviewed and how decisions and approvals are logged.
- How does Cyber NCS deliver 24/7 SOC and MDR?
- At Cyber NCS, 24/7 monitoring and response are delivered by the group's central SOC & MDR hub (Tier-3), DIAMATIX. CyberOM serves SMEs in Israel and Australia and offers an online store; OMNI-SOC is the SOC platform for MSP partners. This guide does not identify AI tools used by DIAMATIX or claim an automation percentage.
Which sources provide further guidance?
- NIST SP 800-61 Rev. 3 — incident response recommendations and considerations for cybersecurity risk management.
- NIST AI Risk Management Framework — guidance for managing risks associated with AI systems.
These sources provide general guidance; they do not describe Cyber NCS or DIAMATIX's implementation.