Reducing alert fatigue: In alert triage, AI agents are reducing alert fatigue by clustering alert patterns and enabling risk-based prioritization, adds Dipto Chakravarty, chief product and technology officer at Black Duck.For example, natural language processing agents can summarize threat alerts at scale and correlate them with threat intel feeds such as CVE.org and the CISA KEV Catalog, he says.”The general incident response workflow is one of the beneficiaries of AI agents where we are seeing the value of automated playbooks for common incidents,” he notes.AI agents are also playing a role in enriching threat intelligence at scale by ingesting and correlating threat intel from myriad sources and consequently enriching these alerts with value-added context such as CVE data.”AI agents today can effectively accelerate derivation of insights from organized and normalized datasets,” by allowing analysts to ask questions in natural language, says Nicole Bucala, CEO at Databee. They eliminate the need for the specialized queries, analytical dashboards, or manual analysis typically required for the task.Instead of flooding analysts with thousands of low-confidence warnings, AI-enabled detection platforms can score and correlate alerts, group related activity into higher-fidelity incidents, and filter out routine or benign behavior. The result, vendors and analysts say, is a reduction in alert fatigue and a shift in analyst workflows away from manual triage toward deeper investigation and response.”AI is helping SOCs escape ‘activity theater’ by turning raw noise into faster, higher-confidence decisions backed by evidence,” says Craig Jones, chief security officer at Ontinue.SOC burnout is a real concern, Jones notes. The biggest drivers of this in the industry are alert volume, fragmentation, and ambiguity, and those pressures exist for any team operating at scale. Analysts, he says, often end up spending too much of their day working high-alert loads that are low signal and then having to context-switch across multiple tools just to assemble the basics of an investigation.
Containing threats sooner: The real win with AI isn’t processing more alerts or closing more tickets; it’s about containing real threats sooner, with fewer mistakes, Jones says.”When AI is used to correlate weak signals into coherent incidents, enrich investigations automatically, and recommend safe next actions inside clear guardrails, you stop measuring effort and start proving outcomes,” he explains.Security experts expect AI to change the skills needed in security teams. Rather than eliminating jobs, it will help security teams automate routine tasks and shift roles toward engineering and system design, Accenture’s Sordilla says. The traditional SOC analyst role, focused heavily on manual log review, is likely to evolve into security engineering roles focused on building resilient systems, automation pipelines, and AI-assisted defenses.Early data shows organizations that have deployed AI for detection engineering are seeing some measurable gains. In a Google study of 3,466 senior leaders, nearly seven in ten (67%) early adopters of agentic AI reported seeing it having a positive impact on their security posture. Of this group, 85% reported described AI as having improved their ability to identify threats. Early adopters of AI, Google noted, are seeing quantifiable benefits not just in terms of efficiency, but also in terms of efficacy.At the same time, experts caution that AI-driven detection is not a silver bullet. Adversaries are increasingly experimenting with AI themselves, using it to generate more convincing phishing campaigns, automate reconnaissance, or modify malware to evade signature-based defenses. That dynamic is pushing defenders to treat AI not simply as another security tool, but as part of a broader evolution in security operations where human expertise, threat intelligence, and machine learning must work together.”Cyberattacks have been industrialized at machine speed,” says Ram Varadarajan, CEO at Acalvio “We need to respond in kind.”That means implementing defensive AI that can handle high-volume technical tasks such as triaging phishing emails, analyzing massive network logs for behavioral anomalies, deploying AI-aware cyber deception, and autonomously quarantining compromised endpoints to prevent lateral movement, he says.”When it’s a machine-speed AI attacker, no human will ever be able to keep up, and these complex AI attacks are going to be launched at scale,” he notes.
Implementing AI correctly: The key to getting the most value out of AI in threat detection is to ensure humans are involved. Any threat finding or resulting remediation action based on those insights, especially those involving nontrivial consequence for business operations, should remain under human oversight, at minimum, says Databee’s Bucala. “Human in the loop is the mantra,” she says. “There’s a lot of business risk that can be incurred through full automation unless the margin of error in machine made decisions is close to zero.”While AI shows promise in threat detection, it still needs refinement. The best practice for organizations is to establish a process that includes human validation, and humans who have the right attention to detail and context to spot check AI summary results and decisions, Bucala notes.AI, adds Accenture’s Sordilla, is not a substitute for basic security hygiene. If an organization already has weak security practices, AI may simply accelerate existing problems. So, companies should first ensure they have strong governance, clear security standards, and mature processes, such as those outlined in frameworks from NIST and International Organization for Standardization, before layering AI into their security programs.”AI is force multiplier,” Sordilla says. “If your company is heading in the wrong direction, you are going down the drain faster,” by deploying AI incorrectly, he cautions.
First seen on csoonline.com
Jump to article: www.csoonline.com/article/4154239/how-ai-is-transforming-threat-detection.html
