AI in the SOC: Which Use Cases Are in Production?

AI in the SOC can mean anything from helping an analyst investigate an alert to recommending that a production server be isolated. 

Both count as AI adoption, but they carry very different risks, permissions, and consequences when something goes wrong. 

For security leaders deciding where to invest, understanding which use cases are actually working in production is very important. 

TryHackMe Research Report

In our most recent report, The Hard Part Is Still Human, we examined how security teams are using AI in practice. 

Across 43 organisations, we identified 78 distinct AI use cases: 21 in production, 19 in pilot, and 38 still being explored. 

The production use cases concentrated on tasks such as alert triage, enrichment, timeline reconstruction, and drafting detection rules or reports. 

In each case, AI supported the investigation while analysts retained responsibility for consequential decisions. 

That pattern offers SOC leaders a practical starting point. Before introducing AI into another workflow, consider where it can reduce analyst workload, how its output will be verified, and which decisions should remain with your team. 

We'll break down the use cases making it into production, those still being tested, and what the findings mean for your SOC’s AI strategy.

What the Production Numbers Measure

TryHackMe’s wider investigation covered 838 security organisations, with 43 providing enough detail to examine how AI was being used in their security operations. 

Of the 78 use cases, 57 were still in pilot or exploration. That shows how much of the AI activity discussed had yet to reach production. 

It does not tell us how long those pilots had been running, whether they eventually succeeded, or how much value the production deployments delivered. 

For SOC leaders evaluating AI tools, this makes the next question more important: What exactly is running in production, and how does it work?

An AI tool summarising alerts during every shift and an agent authorised to isolate endpoints may both be described as production deployments. But they carry very different operational risks and require different levels of oversight. 

Where AI Is Already Supporting SOC Work

Alert Triage and Enrichment

AI can help analysts investigate alerts by gathering relevant context and summarising the activity that triggered them. 

This may include information about the affected asset, related events, and possible reasons an alert deserves further investigation. 

For example, an alert involving unusual PowerShell activity could be enriched with the process history, associated user activity, and relevant endpoint events. The analyst can then review that evidence to determine whether the behaviour warrants escalation. 

The challenge is ensuring the summary reflects the available evidence. Important context may sit in another security tool or be missing from the investigation entirely. 

Teams should therefore make it easy for analysts to inspect the original events, identify which sources were used, and distinguish confirmed activity from the model’s interpretation. This helps analysts work through alerts faster while retaining the evidence needed to make a sound decision.

Timeline Reconstruction

During an incident, analysts often need to piece together events from several systems to understand how an attack developed. 

AI can help organise logs and other evidence into a chronological timeline, giving investigators a clearer picture of what happened and where to focus next. 

The challenge is maintaining accuracy when records come from different sources. Timestamps may use different time zones, telemetry may be incomplete, and events occurring close together may have no direct relationship. 

Each significant event should therefore remain linked to its original evidence, with any timestamp adjustments clearly documented. 

Gaps and uncertain relationships also need to remain visible so investigators can identify what still requires attention. 

Detection Rule Drafting

AI is also being used to help detection engineers write rules based on specific threats or suspicious behaviour. 

This can reduce the initial work involved in translating a detection idea into a query or rule that engineers can refine. 

However, a generated rule may reference fields that are unavailable in the organisation’s environment, miss relevant attack variations, or produce excessive false positives. 

Before deployment, engineers need to test the rule against representative benign and suspicious activity. They can then refine the logic, evaluate the results, and confirm that it works with their existing telemetry. 

Keeping rule generation and deployment as separate steps gives teams room to validate changes before they affect live detection workflows. 

Incident Reporting

AI can help security teams turn investigation notes, logs, and case records into an initial incident report. This is particularly useful when analysts need to communicate findings across shifts or prepare updates for incident commanders and security leaders. 

The generated report still needs to accurately reflect what the investigation established. 

For example, confirming that an endpoint was isolated does not necessarily mean the incident was contained. The attacker may still have access to other systems or compromised accounts. 

This is because AI can produce convincing explanations even when the supporting evidence is incomplete. NIST’s Generative AI Profile identifies confabulation as a risk where generated content presents false or erroneous information with unwarranted confidence. 

Teams using AI for reporting should verify material claims against the incident record, particularly statements about affected systems, response actions, and containment outcomes. 

The benefit is a faster reporting process that preserves the accuracy and accountability expected of a security investigation. 

Choose an AI Use Case Your Team Can Sustain

Start with a recurring SOC task that has a clear owner and a measurable outcome. 

For instance, instead of a broad goal to improve triage, you could test whether AI can produce accurate, source-linked summaries for a specific alert type while analysts retain responsibility for escalation. 

That gives your team a defined workflow to evaluate, with clear expectations around accuracy, efficiency, and oversight. 

Define What AI Can Do

Establish what the system should produce, which information it can access, and which actions require approval. 

For an alert summarisation workflow, AI might read approved case evidence and prepare a draft for review. Changing an alert’s severity or closing a case would require additional controls because those actions affect how incidents are handled. 

The system should also make missing information clear. If it cannot access identity logs, for example, the analyst needs to know before drawing conclusions about account activity. 

The joint government guidance on deploying AI systems securely recommends assessing deployment risks, assigning responsibilities, and documenting risk acceptance. 

Define these boundaries early so the team understands what the system can safely do before expanding its access.

Build Verification Into the Trial

Test the use case against a representative set of alerts with known outcomes. Include routine activity, confirmed incidents, incomplete evidence, and cases where different sources appear to contradict each other. 

Also ask analysts to review the output and record what they corrected, which evidence supported their decisions, and how much time the process took. 

This helps establish whether AI genuinely reduces investigation time or simply shifts the workload toward checking its conclusions. 

The goal is to understand how reliably the workflow performs and whether your team has the capacity to review its output consistently. 

Check Whether Your Data Supports the Use Case

AI can only work with the evidence available to it. Before deployment, review which log sources the system can access, whether important fields are consistently collected, and whether analysts can inspect the same supporting evidence. 

If a pilot exposes gaps in logging, integrations, or access permissions, address those dependencies before expanding the workflow. 

That gives your team a stronger foundation for using AI consistently in production.

Measure the Work After the Model Responds

A faster AI response does not always mean a faster investigation. You also need to measure how much time analysts spend checking the output and whether it helps them make better decisions.

For alert summarisation, focus on: 

• Review time: How long do analysts spend verifying and correcting the summary?
• Investigation time: Does AI reduce the time needed to investigate and reach a decision?
• Accuracy: Are there errors that could affect incident severity, scope, or response?
• Escalation quality: Does the next responder receive enough evidence to act confidently?

A Practical Framework for Measuring AI Performance

Start with one defined workflow and establish how it performs. Then run a pilot using comparable cases and measure the same outcomes with AI involved. 

Example: Measuring an AI-assisted triage workflow

Suppose your analysts currently spend an average of 18 minutes investigating a particular alert type.

During a controlled pilot, you record:

• AI generation: 1 minute
• Analyst verification: 5 minutes
• Remaining investigation: 9 minutes
• Total handling time: 15 minutes

That represents a three-minute saving per alert, provided the AI-assisted workflow maintains investigation accuracy and escalation quality.  

Next, decide whether to expand

Before the trial, agree on the minimum improvement required and the level of error your team can accept.

Review the findings against three questions:

• Did AI reduce total handling time after verification?
• Did investigation accuracy and escalation quality stay the same or improve?
• Can analysts consistently review the output without creating a new bottleneck?

Apply the same approach to other use cases. For detection rules, measure draft acceptance and performance after deployment. For timelines, assess factual accuracy and the time needed to verify the sequence. 

Why Greater Decision Authority Changes the Deployment

Some of the AI use cases still being explored include end-to-end investigations, agentic response, and pipelines that turn threat intelligence into detection rules. 

These workflows can give AI greater control over investigative steps and actions across security systems.

Of the 43 organisations studied, 15 discussed autonomy or agentic behaviour, while eight described explicit human approval gates. None reported allowing a model to independently make high-consequence containment or eradication decisions. 

For SOC leaders, the key consideration is how much authority the system should have.

An AI model might correctly recommend isolating an endpoint. Before allowing it to execute that action, teams need to consider:

• Asset accuracy: Has the system correctly identified the affected endpoint?
• Business impact: Could isolation disrupt critical services or legitimate users?
• Approval and accountability: Who authorises the action, and how can it be reviewed or reversed?

Get More From AI With a Better-Prepared SOC

AI can help your SOC investigate alerts faster, organise evidence, and reduce repetitive work. The real value comes when those efficiencies lead to better threat detection, faster decisions, and fewer missed incidents. 

Your analysts still need the judgment to validate findings, recognise threats, and act confidently when the stakes are high.

TryHackMe helps your team develop that capability through realistic, hands-on training.

With SOC Simulator, analysts practice investigating alerts, separating genuine threats from false positives, and making accurate escalation decisions. This helps improve day-to-day efficiency while building confidence in their assessments.

Live Breach brings those skills together at the team level. Your defenders work through realistic incidents, practice containment and recovery, and strengthen coordination under pressure. Performance reporting reveals weaknesses you can address before a real breach. 

Together, they help you build a SOC that can investigate more efficiently, respond more effectively, and make better use of your investment in AI. 

Build a SOC that is ready for what comes next.