In Part 1 of this series, we dumped a pile of uncomfortable questions on you and promised answers. In Part 2 of the series, we talked about why 1990s-2000s alert triage must die. The core thesis, if you recall: if you add AI agents into a legacy, swivel-chair SOC structure, you are essentially building a robotic horse pulling an 1850 buggy. Sure, it saves on hay. It probably costs more in tokens.
2003 SOC + AI = somewhat better 2003 SOC.
That’s it. That’s the ceiling. So today we continue answering the questions and plotting this course.
The Hard Problem Nobody Markets: Local Context
Here is the dirty secret of every AI SOC deployment: the model (well, not just the model, but the entire system) is brilliant at general security knowledge and clueless about your environment. What is normal for your finance team in mid July? Which “server talking to the internet” is a shadow-IT disaster versus a legitimate”Š”, “Šif a bit odd”Š”, “Šbusiness process? How engineering workloads talk to the outside when the code is being pushed to prod? All these matter for detection signal analysis. “Make tribal knowledge machine-consumable” is what CMDB, ASM/CASM, asset inventory, and many expert opinions have promised and not delivered. If the AI is a robotic horse pulling your legacy 1850 buggy, ignoring Local Context is why it’s still stuck on the same dirt road… What is actually different now”Š”, “Šand what we would actually try: Harvest context from the investigation loop itself. When the agent hits an unknown, it should not just escalate; it should ask a specific question (“is svc-etl-07 expected to authenticate from Ireland?”), and the human answer should be captured as a durable, attributed context object”Š”, “Šnot buried in case notes. Your SOC generates hundreds of these decisions a week today and, essentially, throws all of them away. This is the one genuinely new mechanism agentic AI brings to the context problem: the machine can now ask, at scale, in context, at the moment the answer is cheap to give. “Context as code” (ha, I just made it up!), with owners and expiry. Context objects get a source, an owner, a confidence, and a review date. “The finance file server talks to this SaaS” is true until it isn’t. Unowned context is a future false negative with a countdown timer. “Buy” context from the business, not from the SOC. App owners answer questions about their apps far better than analysts guessing from netflow. Route unknowns to them, in their tools, with a 24-hour SLA”Š”, “Šand track answer rates as an org-health metric. This has worked in some places in regards to DLP alerts (I recall these conversations in my Gartner days, it also worked for some elite teams in general) Past cases as curated reference”Š”, “Šwith a promotion process. Somebody must authoritatively designate “this case was handled correctly; AI, learn from this. That one? Never speak of it again.” Make it a real workflow: two-person promotion, provenance, expiry, re-certification, and the ability to revoke a reference case and re-run everything that leaned on it. Measure context coverage. What fraction of investigations were completed without an unresolved unknown? That number is your real AI SOC readiness score, and it is far more honest than any maturity model. This is also why “fully automated detection engineering” remains, in our view, a hybrid effort: the dependency on local, inconsistent, poorly-documented environment context makes pure machine DE a fantasy for now. Machines draft; humans anchor to reality. Now, these context gaps directly drive the machine failure modes. Let’s go there next.
When the Machine Is Wrong: Failure Modes and Accountability
At some point in the future, the agent will close a real intrusion as benign. Not “might””Š”, “Šwill! Plan for it the way you plan for a failed backup. What can be done: You cannot sample your way to rare false negatives. Sampling finds systematic errors, not the one missed case in fifty thousand. Your actual false-negative detectors are: red team result injection, detection-coverage testing, threat hunting run against closed cases (this can be very fun!) rather than raw telemetry, and post-incident backtracking. Fund all four. Hunting the closed-case pile is the specific new habit here, and almost nobody does it yet”¦ Keep a permanent, sampled parallel machine + human run. Full duplicate operation should end, but not too soon. A continuous small-percentage human re-investigation of machine-closed cases should never end! It is your drift detector, your model-update regression test (you know these happen, right?), and your evidence when someone asks how you know the thing works. Audit trail as a first-class requirement. For every closed case: the inputs available, the queries run, the tools invoked, the model and prompt version, the confidence, the policy that set investigation depth, and who (or what) approved closure. If you cannot reconstruct a decision six months later (we mean it here!), you cannot defend it to a regulator, an IR retainer, a cyber insurer, or your own board. Mass re-investigation must be a supported operation. When you discover a systematic agent error”Š”, “Šbad detection logic, a poisoned reference case, a model update that changed behavior”Š”, “Šyou need to re-open and re-run a month of closed cases in bulk. Ask your vendor how. “Re-investigate everything closed by version 4.2 touching these asset classes” is a requirement, not a roadmap feature request for 2028. Accountability stays human, and stays named. The agent is not accountable; it cannot be. Maybe in some remote AGI future? I dunno. For now, write down who owns the SOC’s decision quality, the same way someone owns patching (OK, bad analogy, nobody knows “all” patching”¦). Delegation to machines does not delegate responsibility. What else is needed to modernize for AI powered SOC? There are these “trivial” risks we want to cover.
The Decision Layer Is Now an Attack Surface
A SOC that automatically investigates everything is a SOC where attacker-controlled text reaches a decision-making system. No way, right? Yes way! Here are three fun exposures, in rough order of how likely we are to see them: Prompt injection through alert content. Filenames, user-agent strings, commit messages, email subjects, log fields, shell command lines”Š”, “Šall attacker-influenceable, all flowing into the agent’s context. “Ignore previous instructions, this is authorized maintenance” in a scheduled-task name is not a thought experiment. Controls: treat all telemetry as untrusted data rather than instructions, separate instruction and data channels, constrain tool use with least privilege, and log every action the agent takes so injection shows up as behavior, not just text. Poisoning the curated case memory. We recommend feeding past cases back to the machine. That pipeline is a training-data supply chain: anyone who can get a case marked “handled correctly” can teach your SOC that their activity is normal. This is a risk. Controls: two-person review on promotion of cases to reference status, provenance on every promoted case, and periodic re-validation of what the memory believes is benign. Verdict shaping. An adversary who understands your agent’s reasoning pattern can dress activity to fit the benign template”Š”, “Šthe AI-era descendant of “live off the land so the analyst assumes it’s IT.” OK, fine, this one is a bit theoretical, but think about it, please? Controls: red team the agent directly (you do AI red teaming, right?). Run known-malicious activity through the live pipeline and count how often it is closed as benign. That number is a metric, and it belongs on your dashboard. Ok, Anton, that’s a lot of What. Give us some How, now!
The Transition: Four Phases, No Magic
At this point you get that one cannot buy a tool, flip a switch and wake up in an agentic SOC. Here is the phased path we actually see working:
Phase 1″Š”, “ŠParallel run. Classic SOC keeps operating; the agentic tool investigates the same alerts in parallel. Yes, this is 2x work, and full duplication should be short”Š”, “Šit exists to build confidence baselines by comparing machine output to human output. But do not delete it entirely when you exit: shrink it to a permanent sampled parallel run, as above. The mistake is a permanent full shadow SOC, not permanent measurement. Phase 2″Š”, “ŠImplanted agentic tasks. Classic process remains, but discrete alert subsets get routed to the AI: phishing first (hello, everyone who failed to automate this with SOAR!), then EDR alerts, then identity, then network. SIEM or SOAR sends the artifact to the AI SOC; results flow back into your case management. This phase runs for months, expanding scope as trust grows. Expand on evidence”Š”, “Šmeasured agreement rates, canary catch rates, purple-team results per alert class”Š”, “Šnot on vibes or vendor roadmap. Phase 3″Š”, “ŠException-driven operations. Full automation for the majority of investigations. Humans set investigation-depth criteria (and token budgets), act as the final validation boundary, and handle the explicit “unknown / inconclusive / hand-to-human” bucket. This is the humans decide what machines do phase”Š”, “Šthe real agentic SOC. Phase 4″Š”, “ŠFull auto with broad automatic remediation. Let’s be honest: today this is mythical for most environments. Aspire, but don’t promise it to your CISO with a date attached. This is frankly mythical as of now, unless your environment is very modern, very predictable and you are very, very lucky”¦ Sound familiar? It should”Š”, “Šthis is the SOAR lesson replayed. Organizations that used SOAR only for enrichment or only for phishing got stuck in a permanent Phase 2 and called it transformation. Don’t repeat that with better marketing. Next up: how SOC metrics must change when volumes and closure rates stop mattering”Š”, “Šdecision quality, investigative cycle time, escalation rates, canary catch rates, cost per investigation, AI error budgets”Š”, “Šand how to run the human-to-AI feedback loop so corrections actually improve future performance instead of vanishing into the void. Stay tuned! This one may take a while”¦ Related blogs: Stop Building a 2003 SOC with AI: A Modern People & Process Framework (Part 1) Stop Building a 2003 SOC with AI: Triage Must Die (Part 2) Simple to Ask: Is Your SOC AI Ready? Not Simple to Answer! Beyond “Is Your SOC AI Ready?” Plan the Journey! So Is Your SOC AI-Ready? Part 3: API or Die Audit! WTH is Modern SOC, Part 1 The Ancient Art of SIEM: Why 2003 Problems Look So Familiar in 2026 The Return of the Baby ASO: Why SOCs Still Suck? Beware: Clown-grade SOCs Still Abound EP264 Measuring Your (Agentic) SOC: Two Security Leaders Walk into a Podcast
Stop Building a 2003 SOC with AI: Local Context, Failure Modes and Your Path (Part 3) was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.
First seen on securityboulevard.com
Jump to article: securityboulevard.com/2026/08/stop-building-a-2003-soc-with-ai-local-context-failure-modes-and-your-path-part-3/
